The phishing emails that worry security teams are not the ones full of spelling mistakes. They look like an invoice from a supplier you really use, a shared document from a colleague, or a password warning from Microsoft. They arrive at a busy moment and ask for one quick action.
The signs that still give them away
- Urgency or pressure: pay today, confirm within the hour, or lose access.
- A request that changes how money moves, such as new bank details for a regular supplier.
- A familiar sender name with an address that is slightly off, or a reply-to address that differs from the sender.
- A link whose real destination, shown when you hover over it, does not match the company it claims to be from.
- A sign-in page reached from an email rather than from a bookmark or the app.
Habits that stop one click becoming a breach
No filter catches everything, so the aim is to make a single mistake cheap. Confirm any change to payment details by phone, using a number you already have rather than one in the email. Open shared files from OneDrive or SharePoint directly instead of through the link. And report anything odd, even after clicking: a quick report lets IT reset a password before it is used.
What IT can put in place
Multi-factor authentication means a stolen password alone is not enough. Mail filtering that scans links and attachments removes much of the obvious noise, and short, regular awareness sessions keep the signs fresh. Identity protection and endpoint protection cover what happens if something does get through: suspicious sign-ins are challenged and a compromised laptop can be isolated.