Identifying Phishing Emails: A Practical Guide for Every User

Phishing is one of the most common—and effective—methods attackers use to steal personal information. It usually shows up as an email that looks legitimate, but is designed to trick you into clicking a malicious link or sharing sensitive details.

What Is Phishing?

A phishing email is a fake message that pretends to come from a trusted source in order to trick you into giving up passwords, financial information, or other sensitive data.

The Most Common Tricks

1. Urgency and Fear

Attackers use threatening or time-sensitive language to push you into reacting quickly, for example:

• "Your account will be locked in 24 hours."
• "Urgent password reset required."

2. Excitement or Curiosity

They also try to hook you with something tempting or surprising, such as:

• "You've won a prize — claim now!"
• "Invoice attached" (when you weren't expecting one)

Red Flags Anyone Can Notice

Even without being "technical," you can spot many phishing attempts by looking for:

• Slightly misspelled sender address
  For example: support@micorsoft.com instead of support@microsoft.com.
• Poor grammar or awkward phrasing
  Legitimate companies usually use clear, professional language.
• Unfamiliar links
  Hover over the link to preview the URL before clicking. If it looks strange or unrelated, don't click.
• Requests for personal info or login details
  Banks, SaaS tools, and other services will not ask for your password over email.

Real vs Fake: Example Layout

When training your team or users, it helps to show a side-by-side comparison (with personal details blurred).

Safe Actions: What to Do If You're Not Sure

1. Never Click Links Directly

If an email says there's a problem with your account, don't use the link in the message. Instead, open your browser and go to the website yourself by typing the address or using a bookmark.

2. Report the Message as Phishing

Reporting helps train spam filters and protects others in your organization.

• Gmail: Click the three dots in the top-right of the message → Report phishing.
• Outlook: Click the ellipsis (…) → Report → Phishing.

3. Notify Your IT or Security Team

If you're at work, forward the suspicious email (or use the reporting process your company has in place). They can block the sender, update filters, and let others know.