Phishing Email Red Flags: A 15-Point Checklist Before You Click Anything

A phishing email rarely announces itself. It arrives looking like a delivery notice, a payroll update, or a note from a colleague asking you to review a shared document. The design is deliberate: get one click before your judgment catches up. The encouraging part is that phishing is a craft with seams. Learn where those seams are and you can screen a suspicious message in under a minute, often without opening a single file. What follows is a screening routine built the way most attacks actually unfold, from the sender line down to the attachment.

Start With the Sender, Not the Message

Most people read the display name and decide. Attackers count on that. Hover or tap the sender name and look at the full address instead.

Ask three questions. Is the domain after the @ the organisation's real one, or a cousin of it? Does the reply-to address point somewhere else entirely? And is a business message coming from a free consumer mailbox that no finance team would ever use?

Watch for lookalike characters too: rn standing in for m, a zero for the letter o, or a hyphen jammed into a brand name. Subdomain tricks are common — microsoft.account-verify.com belongs to account-verify.com, not Microsoft. If your mail client shows an external-sender warning, treat it as genuine information rather than a nuisance banner.

Urgency Is a Tool, Not a Reason

Pressure is the oldest lever in social engineering. Deadlines measured in hours, threats of account suspension, an invoice that must be paid today, a request to keep the matter private until it is resolved. None of that is evidence the request is real.

Legitimate organisations do send time-sensitive mail, so use a simple test: does the urgency arrive attached to a link, an attachment, or a payment instruction? If so, step out of the email entirely. Call the number you already have on file, open the company app, or message the person through a channel you both used last week.

Be equally wary of authority. A message from a "chief executive" asking for gift cards, a wire transfer, or a quiet favour is a scenario worth confirming in person or by voice, no matter how senior the signature looks.

Links: Where They Say They Go and Where They Actually Go

A link is a claim, not a destination. Preview it before trusting it.

• Hover, don't click. On a phone, press and hold the link to see the full address.
• Read the root domain. The part just before the first single slash is what matters — everything to the left of it can be faked freely.
• Compare text to target. If the visible words say your bank but the preview shows a random string, that is your answer.
• Distrust shortcuts. Shortened links, tracking redirects and QR codes all hide the destination. Scan the code with a viewer that previews the URL first.
• Ignore the padlock. A secure connection means the traffic is encrypted, not that the site is honest.

Attachments That Should Raise Your Pulse

Some file types have no business arriving unexpectedly. An HTML or HTM attachment is a common phishing container: it opens a fake login page locally, often with the address bar hidden. Archives that arrive password-protected, with the password written in the email body, exist to slip past scanners. Disk images such as ISO or IMG files, and Office documents that ask you to enable macros to "see the content", fall into the same category.

Double extensions deserve a mention: invoice.pdf.exe is an executable, and your system may hide the final part. If a "shared document" notification asks you to log in again, particularly when you are already signed into that service, close the tab and open the file from the service directly.

Language, Tone and Small Inconsistencies

Phishing copy often reads slightly wrong. A generic greeting when the sender normally uses your name. A formality level that does not match the relationship — a close colleague writing like a legal notice, or a bank writing like a friend. A signature block that lists the wrong office, a footer for a different country, or a logo with visible pixelation.

Context matters more than spelling. Does the message reference something real — a live project, an actual order, a conversation you had? Does it explain why it is reaching you now? Phishing usually substitutes urgency for context. Genuine messages tend to fit into a story you already recognise.

The 15-Point Check Before You Click

1. The display name matches the actual sender address.
2. The domain after the @ is the organisation's real domain.
3. The reply-to address points to the same domain as the sender.
4. The greeting is specific to you, not "Dear Customer".
5. The message references something real you can verify.
6. The request is expected, or can be confirmed another way.
7. Urgency and threats are absent, or a callback is welcome.
8. Hovering over links previews the expected destination.
9. The link text and the destination agree.
10. No shortened links, redirects, or QR codes stand in for URLs.
11. The attachment is a file type you actually expect.
12. No macro prompts, password-protected archives, or HTML attachments.
13. Formatting and spelling are consistent with earlier mail.
14. The signature and footer details are correct for the organisation.
15. Your instinct says something is off.

If more than one check fails, stop. You do not need certainty to decline a request — you only need a reason to slow down.

When Something Slips Through

Assume it will happen at some point, to someone on the team. What matters is the next five minutes.

If you only opened the message, delete it or report it through your mail client's phishing button. If you clicked a link but entered nothing, close the tab and mention it to whoever handles security, even if it feels minor. If you typed a password, change that password from a different device, turn on multi-factor authentication, and say so quickly. Early reporting is far less costly than silence.

For anything involving money, treat verification as routine rather than rude: confirm payment changes by calling a number you already have, and never one supplied in the email itself. If a payment has already gone out, contact your bank immediately through its official app or the number on your card, and consider seeking professional financial advice for the follow-up. Slowing a payment down costs a few minutes. Rushing one can cost far more.

Photo: Tumisu / Pixabay