How to Spot a Phishing Email: A Guide for Your Whole Team

Phishing is responsible for more than 90% of data breaches. It's not a technical vulnerability — it's a human one. And that means the most important security tool your business has isn't software. It's your team.

The good news: phishing emails, even sophisticated ones, almost always leave clues. Training your team to recognize those clues is one of the most cost-effective security investments you can make.

This guide covers the warning signs every employee should know — and how to build a culture where people feel empowered to question suspicious messages.

Phishing is a type of social engineering attack where an attacker impersonates a trusted person or organization to trick the recipient into taking a harmful action — clicking a malicious link, downloading an attachment, entering credentials on a fake website, or transferring money.

The term "phishing" covers a range of tactics:

• Email phishing: Mass emails sent to large numbers of recipients, often impersonating well-known brands
• Spear phishing: Targeted attacks tailored to a specific individual or organization, using personal details to appear more convincing
• Whaling: Spear phishing aimed specifically at executives or high-value targets
• Smishing: Phishing via SMS text message
• Vishing: Phishing via phone call

For most small businesses, email phishing and spear phishing are the most common threats.

This is the most reliable indicator. Attackers often use email addresses that look legitimate at a glance but don't hold up to scrutiny.

Look for:

• Domain spoofing: [email protected] instead of [email protected] (note the "1" instead of "l")
• Subdomain tricks: paypal.com.secure-login.net — the domain is actually secure-login.net, not paypal.com
• Display name spoofing: The email shows "Your Bank" as the sender name, but the actual address is [email protected]

Always check the actual email address, not just the display name.

Phishing emails almost always create a sense of urgency. "Your account will be suspended in 24 hours." "Immediate action required." "Verify your information now to avoid service interruption."

This urgency is intentional — it's designed to short-circuit your judgment and get you to act before you think. Legitimate organizations rarely demand immediate action via email, and they almost never threaten dire consequences for not clicking a link right now.

When you feel pressured to act immediately, that's exactly when you should slow down.

Legitimate companies that have a relationship with you know your name. "Dear Customer," "Dear Account Holder," or "Dear User" are red flags — they suggest the email was sent to a large list of people, not specifically to you.

That said, sophisticated spear phishing attacks will use your name. The absence of a generic greeting doesn't mean an email is safe.

Before clicking any link in an email, hover over it to see where it actually goes. The displayed text might say www.yourbank.com, but the actual URL might be something completely different.

Watch for:

• URLs that don't match the supposed sender's domain
• Long, complex URLs with random strings of characters
• URLs that use HTTP instead of HTTPS (especially for login pages)
• Shortened URLs (bit.ly, tinyurl, etc.) that hide the actual destination

When in doubt, don't click the link. Instead, navigate directly to the website by typing the address in your browser.

Be skeptical of any unexpected attachment, even from someone you know. Attackers frequently compromise email accounts and use them to send malicious files to the victim's contacts — people who are more likely to open an attachment from a known sender.

Common malicious attachment types include: .exe, .zip, .doc, .xls, .pdf (with embedded scripts), and .html files. If you weren't expecting an attachment, verify with the sender through a separate channel before opening it.

Legitimate organizations — banks, government agencies, software vendors — will never ask you to provide passwords, Social Security numbers, credit card numbers, or other sensitive information via email. If an email asks for this, it's almost certainly a phishing attempt.

Many phishing emails, particularly those originating from overseas, contain grammatical errors, awkward phrasing, or unusual formatting. This is a useful signal, but don't rely on it alone — sophisticated attacks are increasingly well-written.

The most important thing you can do is not act on the email until you've verified it. Here's a simple process:

1. Don't click any links or open any attachments
2. Contact the supposed sender directly — using a phone number or email address you already have, not one provided in the suspicious email
3. Report the email to your IT team or security contact
4. When in doubt, delete it — a legitimate sender will follow up through other channels

Individual vigilance matters, but it's not enough on its own. The most resilient organizations build a culture where:

• Employees feel safe reporting suspicious emails without fear of being judged for "overreacting"
• Security training is regular and practical — not a once-a-year checkbox exercise
• Simulated phishing tests help employees practice recognizing attacks in a low-stakes environment
• Clear escalation paths exist so employees know exactly what to do when they spot something suspicious

One of the most damaging things a business can do is make employees feel embarrassed for falling for a phishing attempt. Attackers are sophisticated, and even security professionals get fooled. What matters is building systems and habits that reduce the likelihood and impact of successful attacks.

Phishing works because it exploits human psychology — urgency, trust, and the desire to be helpful. No amount of technology fully eliminates that risk. But a well-trained team that knows what to look for, feels empowered to question suspicious messages, and knows how to escalate concerns is one of the most effective defenses you have.

The investment in security awareness training pays for itself many times over — not just in breaches prevented, but in the confidence that comes from knowing your team is prepared.

AB Solutions Group helps small businesses build practical security awareness programs and assess their overall cybersecurity posture. Get in touch to learn more.