How to Spot a Phishing Email: A Field Guide for Busy Teams

Phishing is still the most common way attackers get a foot in the door at small businesses, and it isn’t because employees are careless. Modern phishing emails are well written, perfectly branded and timed to land when people are busiest. With AI writing tools, the old giveaways like broken English and odd formatting are fading fast.

The good news is that almost every phishing message still has to do the same few things: get you to trust a sender, create a reason to act quickly, and push you toward a link, an attachment, a login page or a payment. Learn to recognize those moves and you can spot a phish in seconds, regardless of how polished it looks.

This field guide is written for busy teams. It gives you a 30-second check anyone can run, the red flags that matter most in 2026, what to do if someone clicks, and how to build a reporting habit so one person’s suspicion protects the whole office.

Why phishing still works

Phishing works because it exploits normal, helpful behavior. Staff want to pay vendors on time, respond to the boss quickly and keep customers happy. Attackers dress their requests up as exactly those tasks.

The goals usually fall into three buckets:

• Stealing credentials. A fake Microsoft 365, Google, bank or shipping login page captures your username and password, and sometimes your MFA code too.
• Installing malware. An attachment or download gives the attacker remote access, which can lead to data theft or ransomware.
• Moving money directly. A fake invoice, a changed bank account number or a gift card request from someone posing as the owner. This is often called business email compromise (BEC), and the FBI’s Internet Crime Complaint Center consistently ranks it among the costliest types of fraud reported each year.

Attackers also research their targets. Your website’s staff page, LinkedIn profiles, press releases and even out-of-office replies tell them who handles payments, who the boss is and when people are traveling. A message that mentions a real colleague, a real vendor or a real project is not automatically genuine.

Knowing the goal helps you spot the ask. If a message ends with “log in,” “open,” “pay” or “keep this between us,” slow down.

The 30-second phishing check

You don’t need to analyze every email. You need a quick routine for the ones that ask you to do something. Run these four checks, in this order:

1. Sender: Look at the full email address, not just the display name. Is the domain exactly right? Is this someone who normally emails you about this topic?
2. Request: What does it want you to do? Log in, open a file, pay, change details, buy gift cards, share data? Is that normal for this person and this process?
3. Pressure: Is there a deadline, a threat (account suspended, late fee, legal action) or a request for secrecy? Urgency is the attacker’s best tool because it skips your judgment.
4. Destination: Where does the link actually go? Hover over it on a computer, or press and hold on a phone to preview the address. Does the attachment type make sense?

If any one of these feels off, don’t click, don’t reply and don’t call a number listed in the message. Verify through a channel you already trust, or report it.

Red flags that matter most

Here are the warning signs worth training your eye on, with realistic examples and the right response.

Red flag	What it looks like	What to do
Lookalike domain	[email protected] or micros0ft-support.com	Compare to a past genuine email; report it
Display name mismatch	“Dave (CEO)” but the address is a free webmail account	Contact the person on a known number
Changed payment details	“We’ve moved banks, please update our account before Friday’s payment”	Call the vendor on the number on file before changing anything
Unexpected login prompt	“Your mailbox is full, sign in to keep receiving email”	Go to the service directly by typing its address or using a bookmark
Shared-document lure	“A secure document has been shared with you” from someone you don’t know	Don’t sign in from the link; ask the sender separately
Odd attachment type	An .html, .iso, .zip with a password or a macro-enabled .docm file	Don’t open it; report it
Gift card or secrecy request	“I’m in a meeting, buy five gift cards for a client and send me the codes”	Always verify in person or by phone
Reply-to differs from sender	From your vendor, but replies go to an unfamiliar address	Check the reply-to field before responding

Sender tricks to know

Attackers use three main approaches to look legitimate. Spoofing fakes the “from” address entirely; email authentication (SPF, DKIM and DMARC) catches much of this, but not all of it. Lookalike domains swap a letter, add a hyphen or use a different ending, such as .co instead of .com. Compromised real accounts are the hardest: the email genuinely comes from your vendor or client because their mailbox was hacked. In that case the address checks out, so the request itself is your best clue.

Link and attachment tricks

The text of a link or button can say anything. What matters is the actual address. Read web addresses from right to left starting at the first single slash: in https://login.microsoft.com.account-verify.net/, the real domain is account-verify.net, not microsoft.com.

Attackers increasingly host phishing pages on legitimate services such as file-sharing sites, form builders and document-signing platforms, so a trustworthy-looking domain is not proof of safety. Ask whether you expected the file in the first place.

Phishing beyond email

The same tricks now travel through every channel your team uses. Train for all of them:

• Text messages (smishing): fake delivery notices, bank alerts and “this is your CEO, what’s your cell number?” messages.
• Phone calls (vishing): callers posing as IT support, your bank or a vendor. AI voice cloning means a familiar-sounding voice is no longer proof of identity.
• QR codes: a code in an email or on a printed flyer that leads to a fake login page. Because it opens on a phone, it often bypasses company email filters. Treat QR codes in emails asking you to sign in as a red flag.
• MFA fatigue: a flood of sign-in approval prompts you didn’t request, hoping you’ll tap “Approve” to make them stop. Never approve a prompt you didn’t start; report it, because it means someone has your password.
• Collaboration apps: messages in Teams, Slack or similar tools from “external” users posing as help desk staff.

What to do if someone clicked

Clicking happens to careful people. What determines the damage is how quickly you respond. Post these steps somewhere visible:

1. Stop and don’t continue. Close the page. Don’t enter any more information.
2. Report it immediately to your IT contact or designated security person. Say exactly what happened: clicked a link, entered a password, opened a file, approved a prompt.
3. If you entered a password, change it right away from a trusted device, and change it anywhere else you reused it. Your admin should sign you out of all sessions and check for new mailbox rules or forwarding.
4. If you opened a file or installed something, disconnect the device from Wi-Fi or unplug the network cable, but leave it powered on so it can be examined.
5. If money moved, call your bank’s fraud line immediately and ask about recalling the transfer, then file a report with the FBI’s Internet Crime Complaint Center (IC3). Speed matters for any chance of recovery.

Build a reporting habit, not a blame culture

Your goal isn’t zero clicks; it’s fast reports. One employee who reports a phishing email within minutes can protect everyone else who received the same message. That only happens if reporting is easy and nobody gets punished for an honest mistake.

• Give people one simple way to report. A “Report phishing” button in Outlook or Gmail, or a single shared address. Don’t make them figure out who to tell.
• Respond to every report. A quick “Thanks, that one was malicious, we’ve blocked it” reinforces the behavior far better than any poster.
• Share real examples. Once a month, show the team a phishing message your business actually received and point out the clues.
• Practice safely. Simulated phishing emails let staff build the habit in a low-stakes way. Use them to teach, not to shame.

Our phishing simulation and testing service runs realistic campaigns tailored to the scams your industry actually sees, with short follow-up lessons for anyone who clicks.

Technical controls that back your people up

People are an important layer, but they shouldn’t be the only one. These settings catch much of the phishing before it reaches an inbox, and limit the damage when something slips through:

That last point is underrated: a password manager matches saved logins to the exact website address, so if it doesn’t offer to fill your password, treat that as a warning sign. Learn more in our guide to passwords, passkeys and MFA.

For reporting suspicious messages outside your organization, the CISA guide to recognizing and reporting phishing and the FTC’s ReportFraud site are good places to start.

How SecuritySage can help

Our founder, Dave, spent years on the attacker’s side before turning to defense, so we teach phishing the way attackers think about it: what makes a lure convincing, and which small habits break the spell. Our security awareness training is short, practical and free of jargon, and our phishing simulations give your team safe practice against the scams that target businesses like yours.

Whether you want a one-time workshop, an ongoing simulation program or help setting up the email protections above, we’ll build something that fits your team’s size and schedule. Get started with SecuritySage and turn your staff into your strongest line of defense.