Phishing remains the single most common way attackers get into small and mid-sized businesses — not because firewalls fail, but because a convincing email persuaded a busy person to click. The good news: almost every phishing email carries tells. Here’s what to look for, and what to do when a message doesn’t feel right.

First, forget the old advice

For years, the standard guidance was “look for bad spelling and grammar.” That era is over. Attackers now use the same AI writing tools everyone else does, and modern phishing emails are often flawlessly written, correctly branded, and personalized with details scraped from LinkedIn and your company website. Judging an email by its polish no longer works.

What still works is checking the things attackers can’t easily fake: where the message actually came from, where its links actually go, and whether the request itself makes sense.

The 10 red flags

1. The sender’s address doesn’t match the sender’s name

The display name might say “Microsoft Support” or your CEO’s name, but the actual address is m1crosoft-notify@secure-mail-portal.com or a Gmail account. On phones, mail apps often show only the display name — tap it to reveal the real address. This one check catches a huge share of phishing on its own.

2. The domain is almost right

rnicrosoft.com (r-n, not m). yourbank-secure.com instead of yourbank.com. company.co instead of company.com. Attackers register lookalike domains precisely because our eyes autocorrect them.

3. Links don’t go where they claim

Hover over any link before clicking (on a phone, press and hold). If the text says microsoft.com but the preview shows something else — often a long random URL — that’s your answer. Be especially wary of links “hidden” behind buttons like Review Document or Listen to Voicemail.

4. Manufactured urgency

“Your account will be suspended in 24 hours.” “This invoice is overdue — final notice.” “Are you at your desk? I need this handled in the next hour.” Urgency is the attacker’s most important tool, because people who feel rushed skip the checks on this list. Legitimate organizations almost never demand action within hours under threat of consequence.

5. A request involving money, gift cards, or payment changes

The classic business email compromise play: an email that appears to come from an executive or a vendor asking you to wire funds, buy gift cards, or — most dangerous — update banking details for future payments. Any request to change where money goes deserves a phone call to a number you already have on file. Never verify by replying to the email; you’d just be talking to the attacker.

6. Unexpected attachments

An invoice from a company you don’t do business with. A “shipping notice” when you didn’t order anything. A shared document from a colleague who wouldn’t normally share documents. Attachments — especially .zip and .html files, or documents that ask you to “enable content” — are a primary malware delivery method.

7. A login page you didn’t navigate to yourself

Many phishing campaigns exist purely to steal your Microsoft 365 or Google credentials with a pixel-perfect fake login page. Rule of thumb: never log in through a link in an email. If a message says you need to sign in, open a browser and type the site’s address yourself.

8. Generic greetings from personal senders

“Dear Customer” from your own bank, or a vague “Hello” from someone claiming to know you. Combined with any other flag, treat it as hostile.

9. The request breaks normal process

Your CEO doesn’t normally ask you to buy gift cards. Your vendor doesn’t normally switch banks. Your IT team doesn’t normally ask for your password (in fact, they never should). When an email asks you to do something outside the way things usually work, the deviation itself is the red flag — no matter how legitimate the message looks.

10. Your gut says something’s off

Tone slightly wrong for the person. Timing slightly odd. A signature that’s not quite how they write it. People are better at this than they think. A weird feeling costs you thirty seconds to verify; ignoring it can cost far more.

What to do when an email fails the test

  1. Don’t click, don’t reply, don’t open attachments. Even replying confirms your address is live.
  2. Verify through a different channel. Call the person or company using a number you already have — from your contacts, a previous invoice, or the official website. Not the number in the email.
  3. Report it. Use your email system’s “Report phishing” button if you have one, or forward it to your IT team or provider. Reporting one phish often lets IT purge the same message from every inbox in the company before someone else clicks.
  4. If you already clicked or entered a password: change that password immediately, from a different device if possible, and tell IT right away. Speed matters enormously here, and no reasonable IT team will scold someone for reporting fast. The clicks that turn into breaches are the ones nobody mentions for three days.

What actually protects a business

Individual vigilance is necessary but not sufficient — someone in every organization is having a distracted day. Layered defenses catch what people miss:

  • Multi-factor authentication (MFA) on email and every important system, so a stolen password alone isn’t enough
  • Advanced email filtering that quarantines lookalike domains and malicious attachments before they arrive
  • Security awareness training with periodic simulated phishing, so spotting these flags becomes reflex
  • Endpoint detection and response to catch the malware if a click does happen
  • A no-blame reporting culture, because early reports are what turn incidents into non-events

Phishing succeeds through rush and routine. A workforce that knows these ten checks — and a business with layers behind them — turns the most common attack on small businesses into a mostly harmless annoyance.