How to Spot and Avoid Phishing Emails: A Guide to Staying Cyber-Secure

Introduction

Every day, cybercriminals send millions of phishing emails, attempting to trick individuals and businesses into divulging sensitive information or downloading malicious software. These attacks are becoming more sophisticated, often mimicking trusted organizations, financial institutions, or even colleagues.

In today’s digital landscape, cybersecurity awareness is no longer optional—it’s a necessity. Whether you’re a business leader, guest facing team member, or member of our support services, understanding how to spot and avoid phishing attempts can protect our data, our finances, and our reputation.

In this note, we’ll explore how to recognize phishing emails, best practices to stay safe, and what to do if you suspect an attack.

How to Identify Phishing Emails

Phishing emails often appear legitimate, but there are red flags to watch out for. Here are some common characteristics of phishing attempts:

Unexpected or Unsolicited Requests for Information

• Emails claiming to be from your bank, People team, or IT team, asking for passwords, payment details, or verification codes.
• Requests for urgent payments, personal data updates, or account confirmations that you weren’t expecting.

What to do: Always verify requests directly with the organization using a trusted contact method. Never share sensitive data over email.

Urgent or Alarming Language

• Phrases like "Your account will be locked unless you act now!" or "Immediate action required" create panic, pushing recipients to act hastily.
• Cybercriminals rely on fear and urgency to bypass logical thinking.

What to do: Take a step back. If it’s really urgent, contact the company through official channels—not via email links.

Poor Grammar, Spelling Mistakes, or Unusual Formatting

• Legitimate companies proofread their communications—phishing emails often have typos, odd fonts, or broken formatting.
• Strange spacing, missing logos, or incorrect branding are red flags.

What to do: If an email looks unprofessional, verify the sender’s email address and cross-check it with official sources.

Suspicious Links or Attachments

• Hyperlinks that don’t match the displayed text (hover over links to check!).
• Unexpected attachments with formats like .exe, .zip, or .html that could contain malware.

What to do: Never click links or download attachments unless you are 100% sure they are safe. If in doubt, forward the email to IT Support for analysis.

Best Practices to Avoid Phishing Attacks

Even the most trained professionals can be caught off guard. Here are key strategies to protect yourself and our data:

Don’t Click on Suspicious Links or Attachments

If you weren’t expecting an email, don’t engage. When in doubt, verify the request outside of email (e.g., by phone or through a company’s official website).

Use Multi-Factor Authentication (MFA)

Even if your credentials are stolen, MFA adds an extra layer of security, making it harder for attackers to access your accounts.

Verify Requests Before Taking Action

• If an email claims to be from your line manager, IT team, or finance department, confirm with them in person or via a known phone number.
• Be especially cautious with bank transfer requests or changes to supplier payment details.

Report Suspicious Emails Immediately

Cybersecurity is a team effort. If you receive a phishing attempt:

Report it to IT
Mark it as spam/phishing in your email client
Warn colleagues to prevent others from falling victim

What to Do If You Clicked on a Phishing Email?

Mistakes happen! If you accidentally clicked a phishing link or shared sensitive data, act fast:

Disconnect from WiFi and notify the IT team.
Change your passwords immediately.
Ask IT to scan your device for malware using security software.
Monitor your accounts for any suspicious activity.

The faster you act, the less damage cybercriminals can do.

Final Thoughts: Stay Vigilant, Stay Safe

Phishing attacks are one of the biggest cybersecurity threats facing businesses today. By staying informed, cautious, and proactive, you can significantly reduce the risk of falling victim to these scams.

Educate yourself and your team
Think before you click
Report anything suspicious

Cybersecurity is a shared responsibility—let’s all do our part in keeping data safe!