Spotting phishing attempts
Phishing is how most business breaches start — one convincing email, text, or call that tricks an employee into clicking, paying, or handing over a password. Here’s how your team learns to spot the bait before it bites.
Phishing is a message designed to look like it’s from someone you trust — your bank, Microsoft, a vendor, even your own boss — so you’ll click a link, open an attachment, or approve a payment without thinking twice.
For a business, the stakes are higher than a single inbox. One employee fooled by a fake invoice or a “CEO” gift-card request can cost the company thousands, expose customer data, or hand an attacker the keys to your entire network. The good news: nearly every phishing attempt carries warning signs. Once your team knows what to look for, most attacks fall apart on sight.
See it in action
Anatomy of a phishing email
Here’s a typical phishing email, with the red flags numbered. The legend below explains what gives each one away.
Dear User, 3
We detected unusual sign-in activity on your account, and your access has been temporarily limited. To avoid permanent deactivation of your mailbox, you must verify your login credentials within 24 hours. 5
Verify My Account Now
http://m365-secure-login.ru/verify-account 4
Failure to verify will result in immediate and permanent loss of access to your email and files.
Microsoft Support Team
The checklist
Red flags to train your eye on
No single sign proves a message is fake — but the more of these you spot, the more suspicious you should be.
Know the playbook
The types of phishing businesses face
Phishing isn’t just email anymore. Attackers use whatever channel your team trusts.
Email phishing
Generic lures blasted to many addresses — fake login alerts, delivery notices, invoices. Low effort, but it only takes one click to work.
Spear-phishing
Targeted at a specific person using real details — your name, role, or vendors — to seem completely credible.
Business Email Compromise (CEO fraud)
Impersonates an executive or vendor to request urgent wire transfers, gift cards, or payroll changes. The costliest attack for businesses by far.
Smishing (text messages)
Texts posing as delivery updates, MFA codes, or “the boss’s new number” asking you to click or reply quickly.
Vishing (phone calls)
Calls impersonating IT support, your bank, or a vendor to talk an employee into sharing a password or approving a payment.
QR-code phishing (“quishing”)
Malicious QR codes in emails, invoices, or flyers that lead to credential-stealing sites — and skip most email link filters.
Sound familiar?
Phishing emails businesses see all the time
A few of the most common lures aimed at small businesses and professional offices — and why each one is bait.
An attachment or link “for the invoice” that installs malware or harvests your login. Often spoofs a real vendor you actually work with.
A short, urgent note “from the owner” asking you to buy gift cards or send a wire — and to keep it quiet. Classic Business Email Compromise.
A fake security warning with a “secure your account” button that leads to a convincing but fake login page built to steal your password.
A fake DocuSign, SharePoint, or Google Drive notification. The “View Document” link opens a credential-harvesting page instead.
If a message looks suspicious
What to do when you spot one
Whether you’re sure it’s phishing or just have a bad feeling, follow these steps.
Don’t click, reply, or open attachments
Don’t tap links, open files, scan QR codes, or reply — even to “unsubscribe.” Any interaction can confirm your address is live or trigger a download.
Verify through a known channel
If it claims to be a colleague, vendor, or bank, confirm with them directly using a phone number you already have — never the contact details in the message.
Report it
Forward it to whoever handles your IT and warn your team if it’s targeting the company. Reporting early helps protect everyone else’s inbox.
If you already clicked or entered details
Don’t panic, but act fast: disconnect the device, change the password from a different device, turn on multi-factor authentication, and tell IT immediately. Our Hacked? Start Here guide walks you through containing it.
Build a team that doesn’t take the bait
Technology blocks a lot, but your people are the real last line of defense. A few habits make phishing far less likely to land.
Make reporting easy and blame-free. Staff should feel safe flagging a click without fear of getting in trouble — early reports limit the damage.
Run occasional phishing simulations. Safe, fake tests build real instinct and show you where a little extra coaching helps.
Turn on multi-factor authentication everywhere. If a password is phished, MFA is often what stops the attacker from getting in. Pair it with a business password manager.
Set a verify-by-phone rule for payments. Any request to send money or change banking details gets confirmed by a known phone number — no exceptions.
Keep filtering and software current. Modern email filtering and up-to-date systems quietly stop most attempts before anyone sees them.
Want your team trained to spot the bait?
High Tech Computer Solutions provides patient, plain-English technology support to help your business lock down email, turn on the right protections, and coach your team to recognize phishing before it costs you. One accountable expert who answers the phone.
No obligation. If I’m not the right fit, I’ll say so and point you in a better direction.