For years the advice was simple: if the email is full of spelling mistakes, it's fake. That advice doesn't work anymore. Any scammer can now write a flawless email with AI, with the right logo and your name in the greeting. What they can't fake so easily is the context, and that's where you need to look.

I've already explained why most attacks on companies start with an email. This is the practical part: how to recognise one and what to do if it's too late.

◢What is a phishing email?

It's an email that pretends to come from someone you trust (your bank, a delivery company, the tax office, a supplier, your boss) to get you to do one of three things: click a link to a fake website, open a file that installs something on your device, or hand over details you shouldn't, like passwords, codes or card numbers. The same thing happens by text message (smishing) and phone call (vishing), and almost all the signs apply to all three.

◢8 signs an email is phishing

1. ▹The real sender doesn't add up. Don't trust the display name, check the full address. "Delivery Service" can come from anywhere. Be wary of domains that look like the real one, with swapped letters, extra hyphens or odd endings.
2. ▹It rushes or scares you. Account locked, unpaid fine, parcel on hold, final notice. Urgency is there so you act before you think.
3. ▹It asks for something that company never asks for by email. Your password, your PIN, the code you just got by text, or your full card details. Your bank won't ask for those this way.
4. ▹The link doesn't go where it says. The text can say one thing and the link go somewhere else. Below I explain how to check it without opening it.
5. ▹There's an attachment you weren't expecting. Invoices, delivery notes, zip files, or documents asking you to "enable content" to display properly. That last request is a clear red flag.
6. ▹Payment details have changed. A supplier who "has a new bank account" or a boss asking for an urgent, discreet transfer. It's the most expensive fraud for a business.
7. ▹You weren't expecting it. You haven't ordered anything from that shop, you have no parcels on the way, or you don't use the service. If it doesn't fit what you're doing, be suspicious.
8. ▹Small details are off. A generic greeting, an odd signature, or a tone that doesn't sound like that person. It's the weakest of the eight, because well-crafted emails get this right now, but it adds up.

A single sign doesn't always mean fraud. Two or more together, especially urgency plus a request for details, are enough reason not to touch anything.

◢How to check a link without opening it

On a computer, hover over the link without clicking and look at the address shown in the bottom corner of your browser or email app. On a phone, press and hold the link until the address appears, without tapping "open".

What matters is reading the domain properly: it's the part right before the first slash. In https://yourbank.com.customer-verification.net/login, the real site isn't your bank's, it's customer-verification.net. Scammers put the brand name first precisely because many people read left to right and stop there.

And the rule that protects you most: if an email asks you to log in, don't use its link. Open the site yourself by typing the address, or use the official app. If the alert was real, you'll see it there too.

◢What if it looks like it's from someone I know?

This happens a lot: when an email account is stolen, it's used to write to all its contacts, who trust that sender. If a colleague or supplier asks for something unusual, especially payments, passwords or opening a file, confirm it through another channel. Call them on the number you already had, not the one in the email.

◢I clicked a phishing link: what to do now

Breathe. What makes an incident worse is rarely the click itself, it's the time that goes by before anyone acts. Depending on what you did:

◢How to protect yourself next time

◢If you run a company

A spam filter alone won't stop phishing. It helps a lot when the team knows these signs, when there's an easy way to report a suspicious email, and when any change in bank details is always confirmed by phone, on a known number. Above all, reporting should be rewarded, not punished.

If you want your team to practise this with real examples from their day-to-day work, that's exactly what I cover in my cybersecurity training for companies.