A phishing email pretends to be from someone you trust, such as a bank, a courier, a supplier or your own boss, to trick you into clicking a link, opening a file or giving away a password. Everyone gets them, and good ones fool careful people. This article shows you what to look for and what to do.
Warning signs
- It’s unexpected, or it pressures you. “Your account will be closed today” or “Pay this invoice now” are classic tricks to make you act before you think.
- The sender’s address looks slightly wrong. Look past the name to the address itself, for example a spelling that is one letter off, or an address from a free email service when the message claims to be from a company.
- It asks for something sensitive. Passwords, one-time codes, card details or ID numbers. Real companies don’t ask for these by email.
- The link isn’t where it says. On a computer, hover your mouse over the link, without clicking, and read the address that appears. On a phone, press and hold the link to preview it.
- There’s an attachment you didn’t expect. Be extra careful with files that ask you to “enable content” or “enable macros”.
- A generic greeting or odd wording. “Dear customer” instead of your name, or strange spelling. Don’t rely on this alone, because good phishing emails are well written.
- Money details have changed. A supplier or colleague suddenly gives new bank details. Check by phoning them on a number you already have, never one in the email.
What to do with a suspicious email
- Don’t click any links or open any attachments, and don’t reply.
- Check with the sender another way, such as a phone call to a number you already have or by typing the company’s website address yourself.
- Forward it to us at [email protected] if you’d like us to check it. Attach it as a file if you can, or forward it as it is.
- Then delete it. In Outlook you can also select Report in the toolbar, then Report phishing, if you see that button.
Quick test: stop and ask yourself
- Was I expecting this?
- Does it want me to hurry?
- Does it want a password, a code or money?
If the answer to any of them is yes, stop and check first.
If it doesn’t work
- You aren’t sure whether an email is real. That’s the right time to ask us. A genuine sender will wait.
- You clicked or opened something. Don’t panic. Follow “I clicked a suspicious link: what to do now” straight away.
- You entered your password on a page you now doubt. Change your password straight away (see “Reset your own Microsoft 365 password“) and tell us.