How to Spot Phishing Emails: A Practical Guide for Staff

Phishing works because the message looks normal enough to earn a click. A better staff habit is not memorising a long list of scam examples; it is pausing when a message asks for something unusual and checking a few simple things.

Check who is really asking

Look at the actual sender address, not only the display name. Be careful with lookalike domains and with messages that appear to come from somebody senior but do not match how they normally communicate.

Check what the message wants you to do

Credential requests, MFA approvals, payment changes, gift cards, confidential files and urgent bank-detail changes deserve extra verification.

Check where the link or attachment leads

If a login is required, go to the service directly rather than trusting the link in the message. Treat QR codes as links too; our QR scam guide covers that variation.

Urgency is a signal, not proof

Attackers often try to create a reason not to verify. “Do this before the meeting”, “the invoice is overdue” or “your account will be disabled” should make people slow down, not speed up.

Make reporting easier than guessing

Staff should have one obvious way to report a suspicious message and should be encouraged to report even when they are unsure. The fastest way to make phishing harder is to create a culture where asking is normal.

Phishing awareness is only one layer. Strong identity and email controls limit the impact when somebody does click. See our MFA/account-takeover guide and email security guide.