How to Spot a Phishing Email
Phishing emails pretend to be from someone you trust, such as your bank, Microsoft, a courier or a supplier, to get you to log in on a fake page, open a nasty attachment or pay money to the wrong account. Most of them give themselves away if you know where to look.
Check who really sent it
The name you see at the top of an email can say anything. The address behind it is harder to fake.
- Look at the full address On a computer, hover over the sender's name or click it. On a phone, tap the name. "ANZ Bank" sending from
[email protected]isn't ANZ. - Watch for lookalikes Scammers register names that are one letter off, such as
rnicrosoft.com(r and n instead of m),paypa1.comornzpost-delivery.co. - Hacked accounts look real Some phishing comes from a genuine address belonging to someone you know whose email has been taken over. If a message from a friend or supplier seems out of character, check with them by phone.
Warning signs in the message
- It's urgent Your account will be closed, a payment has failed, a parcel will be returned, or you'll be fined unless you act today.
- It asks you to log in "Confirm your details", "verify your mailbox", "your password expires today".
- It's a document you weren't expecting A shared OneDrive or SharePoint file, a DocuSign envelope, an invoice or a voicemail. These are the most common lures we see in business mailboxes.
- The attachment is an odd type Be very wary of
.html,.htm,.zip,.isoor.exefiles, and of Word or Excel files that ask you to "enable content" or "enable macros". - There's a QR code to scan A QR code in an email is a way to get you onto a fake page on your phone, where it's harder to check the address.
- It doesn't use your name "Dear customer" or just your email address, from a company that knows exactly who you are.
Spelling mistakes used to be a giveaway. Scammers now use AI to write their emails, so a well-written message can still be fake.
Check a link before you click
- On a computer Hover the mouse over the link without clicking. The real address appears at the bottom of the window.
- On a phone Press and hold the link until a preview shows the address, then let go without opening it.
- Read the address from the right The part just before the first single
/is what matters.https://login.microsoftonline.com.verify-account.top/belongs toverify-account.top, not Microsoft.
The safest habit: don't log in from a link in an email at all. Open the app, or type the website address yourself, and check for the message there. If it's real, it'll be waiting for you.
Let your password manager help
A password manager fills in your password only on the real website it was saved for. If you land on a page that looks exactly like your bank or Microsoft 365 and the password manager offers nothing, stop. That's often the first sign you're on a fake page.
What to do with a phishing email
- Don't reply, click or open attachments
- Report it In Outlook, use Report then Report phishing. In Gmail, open the message, click the three dots and choose Report phishing. This helps block it for everyone.
- Tell your team At work, let whoever looks after your IT know, because the same email has often gone to everyone.
- Delete it
Clicked already? See what to do if you clicked a phishing link. Want to practise? Try our phishing quiz. Not sure about a message? Forward it to us or call 03 548-2220 and we'll take a look.