Phishing has moved on from bad spelling
The old advice was to look for poor spelling and grammar. That still catches the laziest attempts, but many phishing emails are now well written, correctly branded and sometimes generated with AI tools that produce fluent, natural English. Relying on mistakes alone will let the better ones through. The more reliable approach is to judge an email by what it asks you to do. Almost every phishing message ends with a request: sign in, open a document, pay something, confirm details or reply with information. Once you notice the request, you can ask whether it's expected and whether you can check it another way.
Check one: who really sent it
Your email app shows a display name, which anyone can set to anything. Open the full sender address and read it carefully. Watch for free webmail addresses claiming to be a business, extra words in the domain such as microsoft-support-team.com, swapped letters like rn for m, or a different ending such as .co instead of .co.nz.
Also notice whether the message came from inside or outside your organisation. If your email system adds an 'external' tag, a message that claims to be from a colleague but carries that tag needs a second look. If a familiar contact's tone suddenly changes, or they write about something unexpected, consider whether their account might have been hacked.
Check two: what it wants you to do
Phishing commonly asks you to sign in to see a shared file, a voicemail, a fax, a payslip or a secure message. It might ask you to approve a payment, update bank details, confirm your identity, or download an invoice. Each of those is a normal-sounding request, which is exactly why they work.
Ask whether you were expecting it. If you weren't waiting for a document from that person, didn't order anything from that company, and don't normally get voicemail by email, treat the request with suspicion. When in doubt, go to the service directly by typing its address or using its app, rather than using anything inside the email.
Check three: urgency and emotion
Phishing works best when you don't stop to think, so it creates pressure. Your account will be closed today. Your payment has failed. You've received a large refund. A colleague needs something before a meeting. A legal notice requires a response within 24 hours. Any message that pushes a strong emotion, whether fear, excitement or the urge to help, deserves a pause. A useful habit is to notice when you feel rushed and treat that feeling itself as a warning sign. Genuine organisations rarely need an answer in the next ten minutes, and a short delay to check costs almost nothing.
Check four: where the link actually goes
Before clicking, hover over a link on a computer, or press and hold on a phone, to see the real address. The text of a link can say anything, so only the underlying address counts. Read the domain, which is the part just before the first single slash, from right to left. In login.microsoftonline.com.verify-user.net, the real domain is verify-user.net, not Microsoft. If you've already clicked and land on a sign-in page, look at the address bar before typing anything. A fake page can copy the look of Microsoft 365 or Google perfectly, but it can't use their real web address. If anything about the address seems off, close the tab.
What to do with a suspicious email
Don't reply, click or forward it to colleagues to ask what they think, which spreads the risk. Use the report button in Outlook or Gmail if your organisation has one, or forward it to whoever looks after your IT, then delete it. Reporting helps your email filters learn and lets IT warn others who got the same message. If you're not sure, ask. Most IT people would much rather check ten genuine emails than clean up after one phishing click. Building that habit across the whole office is one of the cheapest security improvements a small business can make.
The phishing themes that come round every year
Some phishing themes repeat on a predictable calendar. Fake IRD refund notices appear around the end of the tax year, delivery scams rise before Christmas, fake payroll or HR policy updates appear in the new year, and fake Microsoft notices about storage limits or expiring passwords run all year round. Knowing the seasonal patterns helps staff recognise a familiar trick in new clothes. Phishing also follows the news. After a major data breach, scammers send messages offering compensation or account checks to people who may have been affected. Any message that ties itself to a recent headline and then asks you to act deserves the same four checks.
In short
- Judge an email by what it asks you to do, not by its spelling.
- Read the full sender address and watch for external tags.
- Treat urgency and strong emotion as warning signs.
- Check where a link really goes before clicking or typing a password.
- Report suspicious emails rather than forwarding them around.