How to Recognize Phishing Emails: A Practical Guide for Staff

Q: What are the most common signs of a phishing email?

The most reliable signs are a sender address that does not match the display name, a lookalike domain that is one letter off, urgency paired with a threat or a request for secrecy, a link whose destination differs from its text, and an attachment or request you were not expecting. Any request to change payment details or share a security code should be treated as phishing until verified by phone.

Q: What should an employee do if they receive a suspicious email?

Do not click links, open attachments, reply, or forward it to coworkers. Report it using the report button in Outlook or by calling the help desk, and say whether anything was clicked or entered. Reporting quickly, even after a mistake, gives IT time to contain the problem, so a good office rewards reporting rather than punishing the click.

Q: Why did a phishing email get through our spam filter?

Filters catch bulk campaigns well but struggle with targeted messages from newly registered domains, emails sent from a real but compromised account at a legitimate company, and links that switch to a malicious page after the filter has scanned them. That is why staff awareness remains essential even with strong email security in place; the two layers cover each other's gaps.

You can recognize most phishing emails by checking four things before you act: does the sender's actual email address match who they claim to be, is the message pushing urgency or secrecy, does the link go where the text says it goes, and were you expecting this attachment or request at all. If any answer makes you pause, do not click, do not reply, and report it. That habit, applied consistently by every person in the office, stops the majority of attacks we see against Treasure Coast businesses.

How to recognize phishing emails: the tells that actually show up

Training materials love misspelled emails from foreign princes. Real phishing today is cleaner than that. These are the patterns we see hitting Vero Beach medical offices, Stuart law firms, and Port St. Lucie contractors week after week.

The display name matches, the address does not

The email shows the name of your boss, your bank, or a vendor you use. Hover over or tap the sender name and the real address is a random Gmail account or a domain that is one letter off. Attackers know most people read the name and never look at the address, especially on a phone.

Lookalike domains

Your vendor is at acme-marine.com and the email comes from acme-marine.co, or acmemarine.com, or acme-marine.com.invoice-portal.net. Read the part just before the first single slash carefully. The real domain is the last two pieces before that slash, and everything in front of it can be anything the attacker wants.

Urgency, secrecy, or authority

The invoice is overdue and service will be cut off today. The CEO needs gift cards for a client and is in a meeting so cannot talk. Your mailbox is full and will be deleted in 24 hours. Legitimate organizations rarely combine a deadline with a threat, and your actual boss has never once needed you to buy gift cards quietly.

The link text and the link destination disagree

On a computer, hover over the link without clicking and look at the address that appears. On a phone, press and hold to preview it. If the text says Microsoft and the address is a shortened link or an unrelated domain, it is a phish. Be especially careful with document-sharing notices: a fake OneDrive or DocuSign page that asks you to log in is the most common way business email accounts get stolen.

Unexpected attachments

An invoice from a company you do not do business with. A voicemail attachment from a phone system you do not use. A shipping notice when you ordered nothing. HTML attachments and password-protected ZIP files are almost never legitimate in a business inbox.

A conversation that is real, but hijacked

The most dangerous phishing arrives inside an existing email thread. An attacker has compromised a vendor's mailbox, waits for an invoice discussion, and replies with new bank details. Everything looks right because most of it is. Any change in payment instructions, no matter how it arrives, must be verified by phone using a number you already have, not one in the email.

MFA fatigue

This one does not arrive by email. You get a push notification on your phone asking you to approve a sign-in that you did not start, then another, then another. The attacker already has your password and is hoping you approve one just to make it stop. Never approve a prompt you did not initiate, and report it immediately, because it means your password is compromised.

What should you do when an email looks suspicious?

Keep it simple enough that people actually do it under pressure. Two steps.

Do not click, reply, open, or forward it to a coworker to ask. Forwarding spreads the risk. If you already clicked, that is not a failure, but it changes step two.
Report it. Use the report button in Outlook if your office has one, or call the help desk. Tell them whether you clicked or entered a password. No one will be in trouble for reporting; people only get in trouble for staying quiet.

That second sentence matters. In offices where a click is treated as a firing offense, staff hide mistakes and the attacker gets days of free time. In offices where reporting is praised, we hear about it in minutes and shut it down. If you want the detailed playbook for the click-already-happened case, we have a separate guide on incident response for small businesses.

Why do phishing emails get past the spam filter?

Filters catch bulk, sloppy campaigns very well. They struggle with three things: targeted emails sent to one person from a freshly registered domain, messages from a real but compromised account at a legitimate company, and links that point to a harmless page for the first hour and switch to a credential-stealing page after the filter has scanned it. That is why the human check remains necessary even with excellent email security in place.

Quick checks you can teach in five minutes

Tap or hover the sender. Does the real address match the name and the company?
Read the domain right to left. Is the last part before the slash the company you expect?
Is there a deadline plus a threat, or a request for secrecy?
Hover the link. Does it go where it claims?
Were you expecting this attachment, from this person, right now?
Is anyone asking you to change payment details, buy gift cards, or share a code from your phone?
Did you get a login prompt you did not start?

Print that list and put it near the front desk. It works.

What about text messages and phone calls?

The same tricks arrive as texts (a package is held, a bank alert, a boss asking for a quick favor) and as calls from someone claiming to be Microsoft, your bank, or your IT provider. Your real IT provider will never call and ask for your password or a code from your authenticator app. If a caller asks for either, hang up and call your provider back on the number you already have.

Make it stick with practice

Reading a guide once does not build a reflex. Businesses that run short, periodic simulated phishing tests and a brief refresher a few times a year see click rates fall steadily, which widely reported awareness-training data supports. It also gives you documentation your cyber insurer increasingly asks for.

MainSail Data provides phishing simulation, staff training, and layered email security for businesses across the Treasure Coast. Feel free to share this guide with your team, and call (772) 794-1194 for a free security assessment for your Vero Beach, Fort Pierce, or Stuart office.

How to Recognize Phishing Emails: A Practical Guide for Staff Cybersecurity · 5 min read