How to Spot a Phishing Email (Real Examples, Not Just “Look for Typos”)

The old advice about phishing emails — look for spelling mistakes, bad grammar, a suspicious-looking sender address — isn't wrong, but it's increasingly out of date. Modern phishing emails are often well-written, correctly branded, and genuinely convincing. Here's what's actually worth watching for.

The emotional trigger is usually the first clue

Almost every phishing email is built around urgency or fear: "your account will be suspended," "unusual sign-in detected," "invoice overdue, pay immediately," "your package couldn't be delivered." The goal is to get you to act before you think. If an email is pushing you to do something right now, that pressure itself is worth treating as a warning sign, regardless of how legitimate the email looks otherwise.

Check where links actually go, not just the text

A link that says "Microsoft.com" in the email text can point anywhere at all — the visible text and the actual destination are completely independent. On a computer, hovering over a link (without clicking) usually shows the real destination in the bottom corner of the screen. On a phone, a long press usually does the same. If the real address looks nothing like what you'd expect, don't click it.

Look closely at the sender's actual email address

Not the display name — the full address. "Microsoft Support" as a display name can sit in front of literally any email address underneath it. Look for subtle misspellings of real domains (microsoftt.com, paypa1.com) or addresses that don't match the organisation at all.

Be suspicious of unexpected attachments

An invoice, a delivery note, a "document requiring your signature" — if you weren't expecting it, treat it with caution, especially if it's a file type designed to run code (like .exe, .zip, or a Word/Excel file that asks you to "enable content" or "enable macros" to view it properly). Legitimate organisations rarely need you to enable macros to read a normal document.

Watch for requests that bypass normal process

A genuinely common and effective version of this targets businesses directly: an email that appears to be from a director or manager, asking for an urgent bank transfer, gift card purchase, or change to supplier payment details — often timed for when that person is known to be travelling or unreachable to verify it quickly. If a payment or banking-detail request arrives by email alone and skips your normal process, verify it by phone before acting, using a number you already have, not one from the email.

Trust your instinct, even if you can't say why

Sometimes something just feels slightly off about an email — the tone doesn't quite match how that person normally writes, or the timing is odd. That instinct is worth listening to. It costs nothing to verify something through a separate channel (a phone call, a message through a different app) before acting on an email request that seems unusual.

What to actually do if you spot one

Don't click anything, don't reply, and don't forward it to "check with a colleague" unless your email system has a proper reporting method. Most business email systems have a "report phishing" button — use it if you have one, as it also helps protect your colleagues from the same email. If you're not sure, ask your IT support rather than guessing.

If your business hasn't had staff phishing awareness training recently, or you're not sure how well your email filtering actually catches these, our cyber security page covers what we offer, or get in touch to talk it through.