How to spot a phishing email

Summary

This guide helps you troubleshoot and resolve: How to spot a phishing email. Follow the steps below to fix the issue.

Common Causes

Phishing emails are fraudulent messages designed to trick you into revealing sensitive information, such as passwords, banking details, or business credentials. These emails often impersonate trusted organisations, suppliers, or colleagues to create a sense of urgency or authority. Learning to spot the warning signs is one of the most effective ways to protect your business and personal data from cyber threats.

Common Indicators of a Phishing Email

Suspicious Sender Addresses

Check the actual email address, not just the display name. Phishing emails often use addresses that look similar to legitimate ones but contain subtle misspellings or unusual domains.

• Public domains like @gmail.com or @outlook.com used by organisations claiming to be banks or government agencies
• Misspelled domain names, such as @micros0ft.com instead of @microsoft.com
• Unexpected senders claiming to be internal colleagues or suppliers

Urgent or Threatening Language

Phishing messages often pressure you to act immediately by threatening account closure, legal action, or missed deliveries. Be wary of language that demands urgent action without giving you time to verify.

Unexpected Attachments or Links

Do not open attachments or click links you were not expecting, even if they appear to come from someone you know. Hover your mouse over links to preview the actual destination URL before clicking.

Poor Spelling and Grammar

While some phishing emails are well-written, many contain noticeable spelling errors, awkward phrasing, or inconsistent formatting. Australian organisations typically use Australian English spelling, so Americanised spelling in a supposedly local message can be a red flag.

Requests for Sensitive Information

Legitimate organisations will never ask you to reply to an email with your password, credit card number, or tax file number. Treat any such request as suspicious.

Quick Fix Steps

1. Do not click any links or download attachments in the suspicious email.
2. Do not reply to the sender or forward the email to colleagues.
3. Mark the message as junk or phishing in your email application.
4. Delete the email from your inbox and empty your deleted items folder.
5. If you have already clicked a link or entered details, change your affected passwords immediately. For Windows login credentials, see our Password reset (Windows login) guide.
6. Report the email to your IT support team or email provider using their standard reporting process.

Detailed Instructions

How to Report a Suspicious Email in Microsoft Outlook

1. Select the suspicious email in your inbox.
2. Click the Report Message button on the ribbon, or right-click the message and select Report phishing.
3. If the option is unavailable, drag the email into a new message addressed to your IT support team and send it as an attachment.

How to Report a Suspicious Email in Gmail

1. Open the suspicious email.
2. Click the three vertical dots (More) next to the reply button.
3. Select Report phishing from the menu.

How to Report a Suspicious Email in Apple Mail

1. Select the message in your message list.
2. Click the Junk Mail button in the toolbar, or right-click and choose Move to Junk.
3. Forward the email as an attachment to your support contact for further analysis.

What to Do If You Have Already Responded

1. Change the passwords for any accounts you may have compromised.
2. Enable multi-factor authentication where available.
3. Contact your bank immediately if you shared financial details.
4. Report the incident to your IT support team so they can assist with securing your environment.

If you host with us, you don't need to do this yourself — just Open a Ticket and our Brisbane team will get it sorted.

Still Having Issues?