Phishing is one of the most common entry points for attackers. This quick guide helps you recognize phishing attempts, understand what to do immediately, and report the threat so your organization can protect others.
Recognizing Phishing
Common Phishing Red Flags
Phishing emails try to trick you into revealing information or clicking a malicious link. Watch for these warning signs:
- Suspicious sender address: Email appears to be from a trusted company but the domain looks slightly off (e.g., "amaZon.com" instead of "amazon.com")
- Generic greeting: "Dear User" or "Dear Customer" instead of your actual name
- Urgent language: "Click now," "Verify immediately," "Account will be closed"
- Request for sensitive information: Legitimate companies never ask for passwords, credit cards, or SSN via email
- Mismatched links: Hover over a link—the destination URL doesn't match the text shown
- Poor grammar or formatting: Spelling errors, odd spacing, or unprofessional appearance
- Suspicious attachments: Unexpected files, especially .exe, .zip, or macro-enabled documents
- Requests to disable security: "Disable your antivirus," "Turn off your email filter"
Specific Attack Types to Know
Business Email Compromise (BEC): Attacker impersonates a trusted executive or vendor, often requesting wire transfers or urgent action. These emails look legitimate because they're well researched.
Credential Harvesting: Fake login pages or emails that trick you into entering your username and password on a fraudulent site.
Malware Delivery: Emails with infected attachments or links to malicious websites designed to install malware on your device.
What to Do Right Now
Immediate Action Checklist
If You Think You've Been Compromised
- Change your password immediately from a clean device
- Enable or strengthen two-factor authentication (2FA) on important accounts
- Alert your IT team so they can monitor your account for lateral movement
- Check your recent account activity for logins from unfamiliar locations or times
- Consider a credit freeze if personal or financial information was involved
Reporting the Threat
Who to Tell
Internal Reporting: Most organizations have a security team or IT helpdesk. Forward the suspicious email to them. Include the email headers if possible (usually available in "Show original" or "Message details").
External Reporting: You can also report phishing to:
- The company being impersonated (find their security reporting page on their official website)
- Your email provider (Gmail, Outlook, etc.)
- The FBI's IC3 (ic3.gov) for financial loss or serious threats
- CISA (cisa.gov) for cyber threats to critical infrastructure
What Information to Include
- Full email headers (shows routing and sender details)
- Sender email address
- Subject line
- Any URLs or attachments in the email
- When you received it
- Whether anyone in your organization clicked it
Prevention: Do's and Don'ts
- Hover over links to see the actual URL before clicking (don't rely on the link text)
- Check sender email addresses carefully—slight misspellings are common
- Contact companies directly if you're unsure—use the phone number or website on your account
- Use a password manager so you're less likely to enter credentials on a fake site
- Enable two-factor authentication on sensitive accounts
- Keep your email client and browser updated
- Think before you act—legitimate companies don't demand urgent action via email
- Click links in emails from unknown senders or even if they appear to be from trusted sources
- Download attachments you weren't expecting
- Provide passwords, PINs, or personal information via email—legitimate companies never ask for this
- Trust the "From" address alone—it can be spoofed
- Disable security software or email filters, even if an email tells you to
- Wire money or purchase gift cards on demand via email
- Assume an email is safe just because it looks professional
Create a Culture of Reporting
The strongest defense against phishing is a team that reports suspicious emails. Make sure everyone in your organization knows:
- How to report: Where to send suspected phishing (email address, button in email client, help desk ticket, etc.)
- They won't be punished: Reporting a mistake is better than remaining silent
- Reporting saves time: One report stops a threat for everyone
- Training matters: Regular phishing simulations help people stay alert