Cyber Security
How to spot phishing: 12 warning signs and what to do after a click
Today's phishing emails are often flawless and convincing. These twelve warning signs help your team recognise scams in time and respond correctly if someone does click.
Q-entra editorial teamPublished on 6 min read
Contents
- How do you recognise phishing? The short answer
- Check the sender and the content (signs 1 to 4)
- Links, QR codes and attachments (signs 5 to 7)
- Payment fraud (signs 8 and 9)
- Login pages and MFA requests (signs 10 to 12)
- Clicked or unsure: what to do now
- Technical protection: filters, DMARC and strong MFA
- Conclusion: pause, check, report
Key takeaways
- Phishing usually gives itself away through three things: pressure, an unusual request and a sender or link address that does not match the supposed sender.
- Always confirm changed bank details and urgent payment requests from management using a phone number you already know.
- Treat QR codes in emails as critically as links and look at the address bar before every sign-in. Always deny MFA requests you did not trigger yourself.
- Anyone who clicks should report it immediately: acting fast limits the damage, silence makes it worse.
- Filters, DMARC and phishing-resistant MFA lower the risk, but they do not replace an attentive team.
How do you recognise phishing? The short answer
Phishing uses a fake message to get you to click, enter data or pay. Most attempts combine three elements: a sender that seems trustworthy, pressure or curiosity, and an action outside the usual process. Pausing at this combination and checking through a channel you already know stops most attacks.
Spelling mistakes are no longer a reliable sign: AI tools write flawless text in many languages, and some attacks come from genuine but hacked partner mailboxes. These twelve warning signs help you spot well-crafted attempts too.
Check the sender and the content (signs 1 to 4)
1. The sender address does not match the name
The display name can be set to anything; what matters is the address behind it. Watch for domains that only resemble the real one: a swapped letter, rn instead of m, an addition such as -service or .com instead of .at. A different reply-to address is also a warning sign.
2. Time pressure, threats or temptation
Your account will be locked today, the offer ends in an hour: phishing wants you to act before you think. The same goes for unexpected prizes, parcels or refunds. The greater the pressure, the more a short pause matters.
3. An unusual request
Buying gift cards, confirming login details, approving something without the usual signature: if a message asks you to bypass the normal process, be careful, especially if you are also asked to keep it confidential.
4. The context does not fit
An invoice from an unknown supplier, a warning about a service your company does not even use: if a message does not fit your day-to-day work, check it before you open anything.
Links, QR codes and attachments (signs 5 to 7)
5. The link leads somewhere else
On a computer, hover over the link without clicking. On a smartphone, press and hold it. What counts is the domain right before the first slash after https://: the address yourbank.at.example.net belongs to example.net, not to your bank. Shortened links also hide the destination.
6. A QR code instead of a link (quishing)
Increasingly, the link sits in a QR code, for example in a supposed MFA setup request or a PDF. The phone used to scan it is often less well protected than the work computer, and filters do not always detect a link inside an image.
7. An unexpected attachment
Be wary of attachments you did not expect, especially password-protected ZIP files with the password in the email: virus scanners often cannot inspect encrypted archives. If a document asks you to enable content or macros, or an HTML file opens a login page, close it and report the message.
Payment fraud (signs 8 and 9)
8. The bank details have supposedly changed
A supplier announces that future payments should go to a new account. Such messages come from lookalike domains or even from the supplier's genuine but compromised mailbox, in the middle of an ongoing conversation. Confirm any change of bank details by calling a number you already know, never one taken from the message.
9. The supposed boss with a confidential task
In CEO fraud, someone poses as a member of senior management and demands an urgent, confidential transfer, for example for a secret acquisition. They often push to move the conversation to WhatsApp or a private phone. Calls and voice messages can now be faked convincingly too. A four-eyes principle for payments protects effectively here.
Login pages and MFA requests (signs 10 to 12)
10. A login page appears after the click
A shared document, a voicemail, a full mailbox: many phishing emails lead to a convincing fake login page, for example for Microsoft 365. Check the address bar before you type anything. If your password manager does not offer to fill in your credentials, the domain is often wrong.
11. An MFA request you did not trigger
If a sign-in approval appears on your phone while you are not signing in, someone probably knows your password. Attackers sometimes repeat these requests until someone approves out of annoyance (MFA fatigue). Deny the request, report it and change your password. Number matching, where you type a number from the login screen into the app, makes this attack harder.
12. The supposed IT support asks for codes
A call or chat message from a supposed help desk asking you to read out a code, install remote support software or approve a request: genuine IT support never asks for your password or a one-time code. Hang up and call IT back on the number you know.
Clicked or unsure: what to do now
Anyone can click by mistake. What matters is what happens in the next few minutes.
Immediate steps after a click
- Stop entering data and close the page.
- Inform IT immediately, using the agreed emergency contact outside office hours.
- Entered a password? Change it directly on the service's known website, not via the link, and wherever else you use it. IT should end active sessions and check the mailbox for new forwarding rules.
- Opened an attachment or installed something? Disconnect the device from the network but leave it switched on until IT decides.
- Transferred money? Contact your bank at once and report it to the police. The faster you act, the better the chance of stopping the payment.
Reporting suspicious messages internally
Report even if you did not click: the same message often reaches several people, and one report can warn everyone. The easiest route is a report button in the email client or a fixed address for forwarding the message as an attachment. Our article on security awareness training shows how to build this reporting culture.
Technical protection: filters, DMARC and strong MFA
No team catches every message. Technical measures reduce how much phishing arrives and limit the effect of a mistaken click. SPF, DKIM and DMARC, for example, make it harder to forge emails in your domain's name, as our article on SPF, DKIM and DMARC explains.
| Measure | Helps against | Limit |
|---|---|---|
| Email filter with link and attachment checks | Known phishing sites, malicious attachments | New sites and QR codes in images sometimes get through |
| SPF, DKIM and DMARC | Forged senders using your domain | Lookalike domains, hacked partner mailboxes |
| Tagging external emails | Supposed colleagues writing from outside | Easily overlooked over time |
| Phishing-resistant MFA (FIDO2, passkeys) | Stolen passwords, fake login pages | Not every service supports it; no help against payment fraud |
| Call-back and four-eyes principle | Invoice fraud and CEO fraud | Only works without exceptions |
Basic MFA with push approval or an SMS code is much better than a password alone. Some phishing sites, however, relay your input to the real site in real time and capture the code or session too. FIDO2 security keys and passkeys only work on the genuine domain and therefore resist fake login pages.
Conclusion: pause, check, report
Phishing cannot be prevented entirely, but its impact can be greatly reduced. A team that knows the warning signs, confirms payments through a second channel and reports anything suspicious at once denies attackers most of their opportunities. If you want to align email protection, MFA and training in your company, Q-entra supports you with cyber security.
