How to spot a phishing email

Phishing emails are the number one way businesses get compromised — and in 2026, they're harder to spot than ever. AI tools now help scammers write perfect grammar and copy the exact look of real company emails. Knowing what to watch for is the simplest thing your team can do to stay safe.

The short answer

A phishing email tries to trick you into clicking a link, opening an attachment, or handing over login details by pretending to be someone you trust. They used to be easy to spot — dodgy spelling, weird formatting — but modern phishing emails can look identical to the real thing. The key is slowing down and checking before you click.

What to consider

Check the sender address

The display name might say 'Microsoft' but the actual email address could be from a completely unrelated domain — always expand it and look.

Hover before you click

Move your mouse over any link without clicking — if the URL doesn't match where it claims to go, it's almost certainly a phish.

Watch for urgency

Phrases like 'your account will be locked in 24 hours' or 'act now' are designed to stop you thinking clearly — legitimate companies don't panic you into clicking.

Unexpected attachments

If you weren't expecting a file — especially a ZIP, EXE, or document asking you to 'enable macros' — don't open it, even if it looks like it's from a colleague.

Requests for sensitive info

No legitimate company will ask for your password, bank details, or tax file number by email — full stop.

Too good or too scary

Unexpected refunds, prize notifications, or threats about legal action are classic hooks — if it triggers a strong emotional reaction, pause and verify.

Who this guide is for

Business owners who want their team to recognise scam emails before damage is done.
Office staff who handle email daily and want to feel more confident spotting fakes.
Anyone who's received a suspicious email and isn't sure whether it's real.
Businesses that haven't done any phishing awareness training yet.

What to do next

Share this guide with your team. Even a quick five-minute chat about these signs makes a measurable difference.
Set up a reporting process. Make it easy for staff to flag suspicious emails — a shared mailbox or a quick message to your IT person.
Turn on email filtering. Microsoft 365 and Google Workspace both have built-in phishing protection — make sure it's actually switched on and configured.
Enable multi-factor authentication. Even if someone's password gets stolen through a phish, MFA stops the attacker getting in.
Consider phishing simulation. Sending safe test phishing emails to your team is one of the most effective ways to build awareness without waiting for a real attack.

How WaTo can help

We configure email security and phishing filters so the worst ones never reach your inbox.
We set up MFA properly across your business so stolen passwords don't turn into breaches.
We can run phishing awareness sessions with your team — practical, not preachy.
If something suspicious does land, we're a phone call away to check it before anyone clicks.
We monitor for compromised accounts and act fast if something gets through.

Still not sure?

If you've received an email that doesn't look right, send it to us and we'll tell you whether it's genuine. Or if you'd like your email security reviewed, get in touch — it's a quick check that could save a lot of trouble.

Call (08) 7123 0805 Request a quote