How to spot a phishing email
Phishing emails are the number one way businesses get compromised, and in 2026, they're harder to spot than ever. AI tools now help scammers write perfect grammar and copy the exact look of real company emails. Knowing what to watch for is the simplest thing your team can do to stay safe.
Last updated
The short answer
A phishing email tries to trick you into clicking a link, opening an attachment, or handing over login details by pretending to be someone you trust. They used to be easy to spot (dodgy spelling, weird formatting), but modern phishing emails can look identical to the real thing. The trick is to slow down and check before you click.
What to consider
Check the sender address
The display name might say 'Microsoft' but the actual email address could be from a completely unrelated domain. Always expand it and look.
Hover before you click
Move your mouse over any link without clicking. If the URL doesn't match where it claims to go, it's almost certainly a phish.
Watch for urgency
Phrases like 'your account will be locked in 24 hours' or 'act now' are designed to stop you thinking clearly. Legitimate companies don't panic you into clicking.
Unexpected attachments
If you weren't expecting a file (especially a ZIP, EXE, or document asking you to 'enable macros'), don't open it, even if it looks like it's from a colleague.
Requests for sensitive info
No legitimate company will ask for your password, bank details, or tax file number by email. Full stop.
Too good or too scary
Unexpected refunds, prize notifications, or threats about legal action are classic hooks. If it triggers a strong emotional reaction, pause and verify.
Who this guide is for
- Business owners who want their team to recognise scam emails before damage is done.
- Office staff who handle email daily and want to feel more confident spotting fakes.
- Anyone who's received a suspicious email and isn't sure whether it's real.
- Businesses that haven't done any phishing awareness training yet.
What to do next
- Share this guide with your team. Even a quick five-minute chat about these signs makes a measurable difference.
- Set up a reporting process. Make it easy for staff to flag suspicious emails, whether that's a shared mailbox or a quick message to your IT person.
- Turn on email filtering. Microsoft 365 and Google Workspace both have built-in phishing protection. Make sure it's actually switched on and configured.
- Enable multi-factor authentication. Even if someone's password gets stolen through a phish, MFA stops the attacker getting in.
- Consider phishing simulation. Sending safe test phishing emails to your team is one of the most effective ways to build awareness without waiting for a real attack.
How WaTo can help
- We configure email security and phishing filters so most of the worst ones are blocked before they reach your inbox.
- We set up MFA properly across your business so stolen passwords don't turn into breaches.
- We can run phishing awareness sessions with your team, and we keep them practical rather than preachy.
- If something suspicious does land, we're a phone call away to check it before anyone clicks.
- We monitor for compromised accounts and act fast if something gets through.
Related questions
What should I do if I've already clicked a phishing link?
Change your password immediately, enable MFA if you haven't already, and let your IT support know straight away. The faster you act, the less damage is done.
Can phishing emails come from someone I know?
Yes. If a colleague's account has been compromised, phishing emails can come from their actual address. If something feels off about a message from someone you know, verify by phone or in person.
Are phishing emails illegal in Australia?
Yes. Phishing is a criminal offence under the Criminal Code Act. You can report phishing attempts to the ACSC via ReportCyber (cyber.gov.au) and to Scamwatch.
Do spam filters catch all phishing emails?
No filter catches everything, especially targeted attacks aimed at specific people in your business. Filters reduce the volume, but human awareness is still your best last line of defence.
How WaTo can help with this
Still not sure?
If you've received an email that doesn't look right, send it to us and we'll tell you whether it's genuine. Or if you'd like your email security reviewed, get in touch. It's a quick check that could save a lot of trouble.
Mon to Fri, 8:30am to 5pm
