How to Spot a Phishing Email: 12 Signs Every Employee Should Know

Most attacks on small businesses don't start with clever hacking. They start with a phishing email: a message pretending to be from a bank, courier, tax department, client or colleague, designed to make someone click a link, open an attachment or send money. Training your team to recognise one is the cheapest security upgrade you'll ever make.

12 warning signs

1. Urgency or fear: "Your account will be blocked in 24 hours", "GST notice: respond today"
2. Sender address doesn't match: the name says "HDFC Bank" but the address is [email protected]
3. Lookalike domains: jobooweb.co instead of jobooweb.com, or rnicrosoft instead of microsoft
4. Generic greeting: "Dear Customer" from a company that knows your name
5. Links that don't match: hover (or long-press on mobile) to see the real URL before clicking
6. Unexpected attachments: invoices, "payment advice", ZIP files, or Office files asking you to "Enable content"
7. Requests for OTP, passwords or card details: banks and government departments don't ask for these by email
8. Payment detail changes: "We've changed our bank account, please pay the new one". See business email compromise
9. Too good to be true: refunds, prizes, tax refunds you didn't expect
10. Odd language or formatting: unusual phrasing, wrong logos, mismatched fonts (though AI-written phishing is getting more polished)
11. Login pages reached from email: always open your bank or Google account by typing the address yourself
12. Pressure to keep it secret: "Don't tell anyone, the CEO needs this gift-card purchase urgently"

Common Indian phishing themes

• KYC update or "PAN not linked" messages
• Fake GST, income tax refund or e-challan notices
• Courier "delivery failed, pay ₹25 re-delivery fee"
• Electricity bill disconnection warnings
• Fake job offers and "part-time work" tasks

Someone clicked. Now what?

1. Don't panic, don't hide it. Speed matters more than blame
2. Disconnect the device from Wi-Fi if a file was opened
3. Change the password of any account entered on the fake page, from a different device, and enable two-factor authentication
4. If banking details were shared, call the bank immediately and report on cybercrime.gov.in or helpline 1930
5. Run an antivirus scan. See endpoint security for small offices

Make it part of your culture

• A 15-minute session every quarter with real examples
• A simple rule: "Verify by phone before paying or changing bank details"
• Praise people who report suspicious emails
• Protect your own domain from being spoofed. See email spoofing and DMARC

FAQs

Can spam filters stop all phishing?

No. Filters catch most, but targeted phishing still gets through. People are the last line of defence.

Is opening a phishing email dangerous?

Opening is usually low risk. Clicking links, opening attachments or entering details is where harm happens.