Phishing emails still work because they look familiar, sound urgent, and catch people off guard. One careless click can expose email accounts, passwords, money, and client data.
The good news is that most phishing messages follow patterns. Learn the red flags, and it becomes much easier to spot them before damage is done.
What Is Phishing?
Phishing is when a criminal sends you an email pretending to be someone legitimate—your bank, PayPal, Microsoft, Amazon, your boss—and tricks you into revealing sensitive information or downloading malware.
The goal is almost always one of these:
- Steal your password — Get you to enter your login credentials on a fake website
- Trick you into installing malware — Download an attachment that contains a virus or ransomware
- Get you to wire money — Impersonate your boss or a vendor and request an urgent wire transfer
- Harvest personal information — Get you to fill out a form with your SSN, credit card, or financial data
The success rate is horrifyingly high. We see businesses lose $50,000+ from a single phishing email. Not because they got hacked—because an employee fell for it.
Red Flags: How to Spot a Phishing Email
Red Flag #1: Urgent, Threatening Language
The Red Flag
"Your account has been compromised." "Verify your identity immediately." "Your password has expired." "Urgent action required." "Your account will be closed."
Legitimate companies don't send urgent threats in email. They call you, or they ask you to log in directly (not via a link in email).
Red Flag #2: Suspicious Sender Address
The Red Flag
The email says it's from "Amazon" but the sender address is "amazonsupport@amazoon.co.uk" or "amazon-verify@securemail.info". Look closely at the email address, not the display name.
Pro Tip: Email display names are easy to fake. Always check the actual email address (the one after the @ symbol). If it doesn't end in @amazon.com (or @thecompany.com), it's likely phishing.
Red Flag #3: Generic Greetings
The Red Flag
"Dear Customer," "Dear User," "Hello," instead of your actual name.
Real companies know your name. They use it. Phishers don't have your name, so they use generic greetings.
Red Flag #4: Links Don't Match the Text
The Red Flag
The text says "Click here to verify your Amazon account" but the actual link goes to "secure-verify-now.com" or some other random domain.
Pro Tip: Hover over a link (don't click!) to see where it actually goes. If the link URL doesn't match the company name, it's a red flag.
Red Flag #5: Requests for Passwords or Sensitive Data
The Red Flag
"Click the link to update your password," "Confirm your credit card number," "Verify your social security number."
Legitimate companies NEVER ask for passwords, credit cards, or SSNs via email. Ever. If you get this request, it's 100% phishing.
Red Flag #6: Suspicious Attachments
The Red Flag
An email with an unexpected attachment, especially .exe, .zip, .doc, or .xls files from unknown senders.
Phishers use attachments to distribute malware. Even if the attachment name seems legitimate ("Invoice.xlsx" or "Document.pdf"), if you weren't expecting it, don't open it.
Red Flag #7: Poor Grammar or Spelling
The Red Flag
Misspelled words, awkward phrasing, strange capitalization. "Your Acount Has Bein Comprised" or "Please to urgently confirm details."
Professional companies have professional emails. Bad grammar is a strong signal you're dealing with criminals, not the real company.
Red Flag #8: "I'm Your Boss" Scam
The Red Flag
An email that looks like it's from your CEO or manager asking you to urgently wire money, buy gift cards, or wire funds to a vendor.
This is called "business email compromise." Hackers spoof your boss's email and request urgent transfers. Always verify with your boss directly (via phone call, not email reply) before sending money.
What If You Click a Phishing Link?
If you've already clicked a malicious link, don't panic. Here's what to do:
- Close your browser immediately. Don't fill in any information.
- Report it to your IT department or security team right away. Don't be embarrassed—phishing happens to everyone.
- Change your passwords (especially email) from a different device. Use a computer that hasn't visited the phishing site.
- Enable two-factor authentication on your accounts if you haven't already.
- Monitor your accounts for suspicious activity. Watch for unexpected logins or password changes.
The faster you report it, the faster your IT team can contain the damage. Most phishing attacks are caught and stopped before any real harm is done—but only if people report them quickly.
If You Entered Your Password
If you entered your password on a phishing site:
- Change your password immediately. Use a strong, unique password.
- Tell your IT team. They may need to monitor your account for suspicious activity or reset your access.
- Check if the same password is used elsewhere. If you use the same password for email, banking, work systems—change all of them.
- Watch for signs of account compromise: unexpected emails, login attempts from unknown locations, or missing emails.
If a phishing attack compromises your email password, attackers can reset other passwords, access your files, impersonate you, and cause serious damage. It's critical to act immediately.
Protecting Your Business from Phishing
As a business owner, you can't rely on everyone to spot phishing. You need layers of defense:
1. Email Filtering
Modern email systems (like Microsoft 365) automatically scan for phishing emails and flag suspicious ones. This catches the majority of phishing before it reaches employees.
2. Multi-Factor Authentication (MFA)
Even if someone enters a password on a phishing site, they can't get in without the second factor (a code from your phone). This is your insurance policy.
3. Employee Training
Regular security training teaches employees what phishing looks like, what to avoid, and how to report suspicious messages quickly.
4. Device and Account Protection
Managed devices, strong password policies, conditional access, and account monitoring reduce the damage if someone does click something they should not.
Final Takeaway
Phishing emails work because they create urgency and catch people off guard. A calm process, layered security, and regular training make them much easier to stop.
Want better phishing protection for your business?
Guerrero Consulting helps South Jersey businesses improve Microsoft 365 security, email protection, MFA, and staff awareness training.
Book a Free Consultation