Phishing: how to recognise a fraudulent email

What it is

Phishing is a message pretending to be from someone you trust, such as a bank, a supplier, a courier or a colleague, to obtain passwords, data or money. It arrives by email, SMS, messaging apps or phone.

Warning signs

• Urgency: "your account will be blocked today", "payment overdue".
• A sender that doesn't add up: the name is familiar, but the real address is different or has one letter changed.
• Links that lead to a different domain from the one they appear to. On a computer, hover over them without clicking.
• Unexpected attachments, especially compressed files or ones asking you to enable macros.
• Unusual requests: changing bank details, buying gift cards, sending a password.
• A tone or language that doesn't fit the supposed sender.

Today's fraudulent messages can be very well written: the absence of typos is no longer a guarantee.

The frauds that cost the most

• The invoice with new bank details: an email, apparently from a regular supplier, says they've changed bank.
• The fake boss: someone posing as management asks for an urgent, confidential transfer.
• Fake technical support asking you to install remote access software.

The defence is simple: verify through another channel. Call the number you've always used, not the one in the message.

What to do if in doubt

• Don't click or open the attachment.
• Go to the service by typing the address yourself or through the app.
• Ask a colleague or whoever handles IT.

If someone has fallen for it

1. Report it straight away, without fear of blame: every minute counts.
2. Change the affected password and sign out of all sessions.
3. If bank details were given or a payment made, call the bank.
4. If an attachment was opened, disconnect the computer from the network.
5. Check for forwarding rules in the mailbox: attackers often create them.

Technical measures that help

• Two-factor authentication on email and critical services: even with the password, they can't get in.
• A password manager: it won't fill in your login on a fake site.
• SPF, DKIM and DMARC on your domain, so it can't easily be spoofed.
• Email filtering and up-to-date devices.
• Backups, in case everything else fails.

Culture

A written procedure for bank detail changes and urgent payments, and a workplace where asking "is this real?" is welcome, prevent more fraud than any tool.