A phishing email tries to make you take an action that benefits the sender: reveal a password, approve a payment, open a malicious file, share a verification code, install software, or continue the conversation on a less protected channel. Modern phishing can be polished, correctly spelled, personalized, and delivered from a real account that has been compromised. The safest approach is not to hunt for one magical clue. It is to use a verification workflow that separates the message from the decision.

That workflow starts with a pause. You do not need to prove that a message is malicious before refusing to use its link or attachment. You only need enough uncertainty to switch channels. Open the organization’s app directly, use a saved bookmark, call a known number, or start a new message to an address you already trust. Verification is an ordinary business control, not an accusation.

Start with the requested action

Ask what the sender wants and what would happen if the request were false. A newsletter link has a different risk from a request to reset a payroll password. High-risk actions include changing payment details, buying gift cards, sharing credentials, approving multifactor prompts, downloading unexpected files, bypassing a normal process, or keeping the request secret. Urgency and authority can amplify the pressure, but the requested action defines the consequence.

Also notice channel switching. A message may ask you to move to text, a private chat, a personal address, or a phone number included in the message. That can remove the conversation from corporate logging and security controls. Use contact information from an independent source instead of the suspicious message.

Read the identity at three levels

Display name

The visible name can say “Chief Financial Officer” or “Cloud Support” while the underlying address belongs to someone else. Display names are labels, not authentication. Expand the sender details on mobile devices and compare the complete address with the organization’s known domain.

Address and reply path

Look for misspellings, extra words, unusual subdomains, or a reply-to address that differs from the visible sender. A message can be sent from a legitimate marketing platform on behalf of a company, so difference alone is not proof. It is a reason to verify. Be especially cautious when the message asks for a sensitive action but replies go to a free mailbox or an unrelated domain.

Account context

Even a perfect address may be compromised. Ask whether the request matches the person’s role, current project, writing pattern, and established approval process. A real colleague’s mailbox can send a fake invoice. Business-email compromise often succeeds because recipients stop checking once the address looks familiar.

Link text can display one destination while opening another. On a desktop, hover to reveal the target; on a mobile device, press and hold without opening. Read the registered domain from right to left. In login.example.com.attacker.test, the controlling domain is attacker.test, not example.com. Shortened links and redirect services hide the final destination, so use the organization’s app or a bookmark instead.

Do not sign in after arriving through an unexpected message, even when the page looks exact. Password managers provide a useful signal because they normally fill credentials only on the domain where they were saved. If autofill does not appear, stop and verify rather than copying the password manually.

Treat attachments as untrusted input

Unexpected attachments deserve independent confirmation. Common lures include invoices, shared documents, voicemail notices, shipping records, and résumé files. File names can hide their true type, and an archive can contain scripts or installers. A familiar icon does not establish safety. If the document is supposed to be in a known cloud service, open that service directly and look for it there.

Macros and prompts to “enable content” are major warning signs. So are password-protected archives when the password is included in the same email; encryption can prevent automated scanners from inspecting the contents. Organizations should define approved file-sharing channels and teach staff how to route suspicious files to security teams without opening them.

Verify account alerts independently

A message about a login, password reset, delivery failure, or subscription charge may be genuine and still should not control the route you use. Open the official app or type the known site address. Review recent activity and notifications there. If no matching alert exists, report the email. If the alert is real, change credentials from the trusted session and review recovery methods, forwarding rules, connected apps, and active sessions.

Never approve a multifactor prompt you did not initiate. Repeated prompts can be an attempt to wear you down. Deny the request, change the password through a trusted route, and notify the appropriate security contact. A verification code is effectively a short-lived credential; support staff should not ask you to read it back in response to an unsolicited message.

A five-minute verification workflow

  1. Stop. Do not click, reply, call a number in the message, or open the attachment.
  2. Name the action. Write down what the sender wants and the potential harm if the request is false.
  3. Switch channels. Use a saved bookmark, official app, known phone number, or a new message to a trusted address.
  4. Confirm specifics. Ask about the invoice number, project, account alert, or approval using information not supplied by the suspicious message.
  5. Report and preserve. Use the mail system’s phishing-report function or your organization’s process. Reporting can preserve headers and help protect other recipients.
Do not forward a suspected phish as a normal attachment unless your organization instructs you to. Use the built-in reporting control or a documented security mailbox so headers and links can be handled safely.

What to do after clicking

Act quickly, but do not panic. Disconnecting the device may be appropriate if you ran an unknown program, but an accidental page visit is different from installing software. Tell your security team what happened, including the time, device, link, information entered, and files opened. Honest details make containment faster.

If you entered a password, change it from a known-clean device and trusted site, then change any reused passwords. Revoke active sessions, review recovery settings, and enable phishing-resistant multifactor authentication where available. If payment information or money moved, contact the financial institution through a verified number immediately. Preserve the message and any transaction details.

Practice with real workflows, not trivia

Training is strongest when it rehearses the exact verification paths people will use under pressure. Finance staff should practice confirming a changed bank account through a known contact. Support teams should practice a recovery request from a compromised mailbox. Executives should practice refusing secrecy and urgency. The lesson is not to memorize suspicious phrases; it is to make the safe response faster and socially supported.

Build a culture where verification is normal

Phishing resistance is not only an employee-training problem. Leaders should welcome callback verification, finance teams should require dual approval for payment changes, and support teams should never shame someone for reporting a mistake. Simulations can help when they teach specific behaviors, but surprise tests that punish people may reduce future reporting.

Technical controls still matter: domain authentication, attachment sandboxing, URL analysis, least privilege, strong recovery processes, and rapid account revocation all reduce consequences. Continue with the SPF, DKIM, and DMARC guide and the email policy framework.

Authoritative reference

Review CISA phishing guidance ↗

Continue reading