Short answer: If a message rushes you, asks you to click an unexpected link or enter a password, and comes from an address that looks like a known brand but isn't exactly it, it is very likely phishing. When in doubt, don't click: verify with the sender through a channel you already know (a phone number you have, a new email you type yourself).
What is phishing?
Phishing is a scam in which an attacker poses as a trusted organization or person to get you to click a link, open an attachment, or type sensitive information such as a password or card number into a form. It is the most common attack against businesses because a single click by a single employee can be enough to take over a company mailbox, and from there, other accounts.
7 warning signs
1. The sender address looks like the brand, but isn't
The display name may say "PayPal" or "Microsoft 365", but the actual address is something like service@paypal-account-security.com or no-reply@micros0ft-support.net. Always look at the real address, not the display name. Watch for look-alike characters and extra words in the domain.
2. Urgency or threats
"Your account will be closed in 24 hours", "your payment is overdue, act now", "your mailbox is full, verify to keep receiving mail". Pressure is deliberate: it is designed to make you click before you think.
3. The link doesn't go where it says
Hover over a link without clicking (or long-press on a phone) to see the real destination. If "View invoice" leads to bit.ly/xyz123 or a domain that has nothing to do with the sender, be suspicious.
4. Unexpected attachments
Be careful with .zip, .rar, .iso, .html, .exe and .js files, and with macro-enabled .docm or .xlsm documents, especially when they arrive with an unexpected "quote", "invoice" or "shipping notice". Verify with the sender before opening.
5. Sloppy language and inconsistent branding
Official mail from large organizations is carefully produced. Odd phrasing, broken characters, blurry logos and mismatched fonts are red flags. But beware: modern attacks, often written with AI tools, are increasingly polished, so the absence of mistakes does not mean a message is safe.
6. A form asking for your password or card details
Banks, delivery companies and government agencies do not ask you to enter your password or card number through a link in an email. If you land on such a form, check the domain in the address bar twice, and when in doubt, go to the site by typing its address yourself.
7. An unusual request from a familiar name (CEO fraud)
A message carrying your CEO's or a manager's name, but sent from a different address, asking you to "make an urgent payment", change a supplier's bank details or buy gift cards is especially dangerous. Confirm such requests by phone, never by replying to the email.
What to do with a suspicious email
- Don't click any link and don't open any attachment.
- Verify with the sender through another channel: a phone number you already have, or a new message you address yourself.
- Report it to IT or security. If your company has no process for reporting suspicious email, create one now (the Report button in Outlook or Gmail is a good start).
- If you already clicked and entered details, change that account's password immediately, sign out other sessions, and tell IT.
To see where a message really came from, and whether it passed SPF, DKIM and DMARC, paste its headers into the email header analyzer.
Building awareness in your company
Technical controls (SPF, DKIM and DMARC plus an email security gateway) stop most attacks before they reach an inbox, but no system is perfect. Sharing these seven signs with your team and building an "if in doubt, ask; nobody will judge you" culture is the strongest complement to technical protection.
Spambil quarantines the vast majority of phishing emails before they reach your inbox. Point your MX record and try it free for 7 days.
Frequently asked questions
I clicked a link by mistake but didn't enter anything. Am I at risk?
Just opening a link, without filling in a form or downloading a file, is usually low risk. Close the browser tab, make sure your browser and OS are up to date, run an antivirus scan, and let IT know.
Is phishing the same as spam?
No. Spam is unwanted but usually harmless advertising; phishing is a deliberate attack designed to steal information or access. A good filter scans for both, but phishing detection is a separate and more critical layer.
The sender address looks genuine. Can it still be fake?
Yes. On domains without SPF, DKIM and a DMARC policy, the From address can be forged completely, and a legitimate account that has been compromised can also send phishing. An address alone is not proof; see SPF, DKIM and DMARC explained.