How to spot a phishing email

Why phishing still works

Phishing works because it targets people rather than technology. A well-crafted message arrives when someone is busy, looks like something they expect, and asks for a small action such as opening a document, signing in or approving a payment. Attackers now use AI tools to write fluent, error-free messages, so the old advice to look for bad spelling is no longer reliable on its own.

The good news is that almost every phishing email has to get you to do something. If staff learn to recognize the request and pause before acting, most attacks fail at that point, regardless of how convincing the message looks. That pause is the single most valuable habit you can build in your team.

Check the sender carefully

Look at the actual email address, not just the display name. A message showing a colleague's name may come from a personal webmail account or a lookalike domain such as yourcompany-ca.com or a domain with a swapped letter. On a phone, tap the sender name to reveal the full address, because mobile apps often hide it by default.

Be cautious with external messages that appear to come from inside your organization. Many email systems label external mail with a banner or tag. If a message from your manager or your finance team carries an external warning, treat it as suspicious until confirmed. Messages from a real but compromised supplier account are harder to spot, which is why the request matters as much as the sender.

Look at the request, not just the look

Ask what the email wants you to do. Common requests include signing in to view a shared document, confirming a password, paying an overdue invoice, updating banking details, buying gift cards or opening an attachment to see a delivery notice or voicemail. Any request involving credentials, money or changes to payment details deserves a second look, however ordinary it appears.

Pressure is a strong signal. Phrases that create urgency, secrecy or fear, such as a final notice, an account suspension or a request not to discuss something with anyone else, are designed to rush you past your normal judgment. Legitimate organizations rarely need you to act within the hour. When you feel rushed, slow down.

• Unexpected requests to sign in or reset a password
• Changes to banking or payment details
• Urgency, secrecy or threats
• Attachments or links you were not expecting
• Requests to buy gift cards

Inspect links and attachments safely

On a computer, hover over a link without clicking to see where it really goes. The address that appears should match the organization the message claims to be from. Watch for lookalike addresses, extra words before the real domain or link shorteners that hide the destination. When in doubt, do not click the link. Go to the website by typing the address yourself or using a saved bookmark.

Be careful with attachments, especially ones that ask you to enable editing or macros, password-protected zip files and HTML files. Sign-in pages that appear after opening a shared document are a common trick. If your password manager does not autofill on a page where it normally would, that is a strong warning that the site is fake.

What to do if something looks wrong

Do not reply, click or forward the message to colleagues to ask their opinion. Use your organization's report button or forward it to IT as instructed. If the message asks for a payment or a change to banking details, verify by calling the person using a number you already have on file, not one listed in the email.

If you already clicked or entered your password, report it immediately. Speed matters far more than embarrassment, because IT can reset passwords and check for suspicious activity before damage is done. Staff who report quickly should be thanked. Suspected fraud can also be reported to the Canadian Anti-Fraud Centre. Nobody should be disciplined for reporting a mistake promptly.