7 ways to spot a phishing email in 10 seconds
From the sender address to double‑extension attachments: seven checks that catch a suspicious email before you click.
Published: · 4 min read · HilfeX Security Team
- Check the real email address and domain, not the display name.
- Urgency, fear or a reward are the most common levers for a thoughtless click.
- Hover over links and read the actual destination; read domains from right to left.
- Don’t just delete a suspicious email; report it. One report protects the whole organisation.
Phishing is an attack in which someone pretends to be a trusted organisation or person to get you to click a link, open an attachment or share information. A large share of attacks on companies still starts with an email, because the easiest way past the best firewall is one person’s click.
The good news: most phishing emails carry a handful of recurring signs. With a little practice, the seven checks below take less than ten seconds.
1. Check the address, not the name
Mail apps often show only the display name: “Microsoft 365 Security”, “HR Department” or your manager’s name. The sender can type anything there; it proves nothing.
Hover over or tap the name and read the actual email address. If a message from “your bank” comes from a free webmail account or an unrelated domain, stop.
2. Catch the small tricks in the domain
Attackers register addresses that closely resemble real domains. Common techniques:
- Letter imitation: “rn” looks like “m” (rnicrosoft), “l” swaps with “I”, “0” with “o”.
- Extra words: company-support.com or company-security.net feel familiar but are not the company.
- A different ending: .co, .help, .top or .info instead of .com.
- The subdomain trick: in company.com.verify-login.top the real domain is “verify-login.top”; “company.com” is decoration.
Always read domains from right to left: the two parts before the last dot tell you who really owns the address.
3. Slow down when you feel pressured
“Your account will be closed in 24 hours”, “Payment due today”, “Your parcel is being returned” or “Urgent request from the CEO”: these phrases are designed to make you act without thinking. Fear, curiosity, greed and obedience to authority are the oldest tools of social engineering.
If an email rushes you, that alone is a reason to slow down. Legitimate organisations give reasonable deadlines on important matters and contact you through other channels too.
4. Read the link’s real destination
Link text and link destination can differ. Hover over the link (on mobile, press and hold) and read the address that appears. Then apply the domain check from point 2.
Shortened links, QR codes and “View document” buttons are often used to hide the real address. If in doubt, type the organisation’s known address into the browser yourself.
5. Watch attachments and file extensions
Unexpected invoices, delivery notes, payslips and “scanned documents” are classic bait. Be especially careful with:
- Double extensions: Invoice.pdf.html or Quote.docx.exe are not what they seem.
- HTML attachments: they often open a fake sign‑in page locally in your browser.
- Office files asking for macros: “Enable editing to see the content” is a red flag.
- Password‑protected ZIP files: if the password is in the email, the aim may be to bypass scanning.
6. Verify unusual requests through another channel
A supplier announcing new bank details, a manager asking for gift cards, IT asking you to “verify” your password: such requests can even come from a genuine but compromised account. So confirm every unusual request involving money, passwords or sensitive data via a known phone number or in person, never via the number in the email.
7. Take your mail system’s warnings seriously
Many business mail systems tag outside messages as “External” or flag messages that fail authentication checks (SPF, DKIM, DMARC). If an email bearing your manager’s name carries an “External” tag, that alone is a strong signal.
What to do if you’re suspicious
- Don’t click, don’t open attachments, don’t reply.
- Use your company’s reporting route: a “Report phishing” button or the security team’s address.
- If you clicked or entered data, report it immediately and change your password. Fast reporting is the most effective way to stop an attack spreading. Nobody should blame you for it; a late report is always better than a hidden click.
For organisations: how is this reflex built?
Reading these checks once is not enough; reflexes come from repetition. Effective programmes usually combine three things: short, frequent training, realistic phishing simulations and an easy report button. Measure success not only by click rate but by report rate. Fewer clicks are good, but more reports mean your organisation spots a real attack sooner.
The phishing simulations and Outlook reporting add‑in in HilfeX IQ Portal are built for exactly this loop. Try it yourself: the interactive example on our home page hides five signs.
Frequently asked questions
I clicked a phishing email. What should I do?
Stay calm and tell your security or IT team immediately. If you entered a password, change it and make sure multi‑factor authentication is on. The sooner you report, the smaller the damage.
Is just opening a phishing email dangerous?
In current mail apps, simply opening an email usually does not compromise the device. The real risk comes from clicking links, opening attachments, enabling macros or entering data. Reporting the email is still the right move.
If the sender address is correct, is the email safe?
Not always. Attackers can take over real accounts and send from them. Verify unusual requests involving money, passwords or sensitive data via a known phone number.
Why run phishing simulations?
Simulations let employees practise safely before a real attack arrives. In a well‑designed programme the goal is not punishment but a stronger reporting reflex and measurable progress.
