How to spot a phishing email before it costs you

Phishing — fake messages designed to steal passwords or money — is how most small businesses actually get burned. Not sophisticated hacking: one busy person, one convincing email, one click. The emails look genuinely professional now, logos and all. But the underlying tricks haven't changed, and they're learnable.

The feeling to watch for: urgency

Nearly every phishing message manufactures pressure: "Your account will be suspended in 24 hours." "Unpaid invoice — final notice." "It's the boss, I need gift cards for clients, are you available right now?" Urgency is the tell, because urgency is what stops people from thinking. Real companies almost never demand action within hours on threat of disaster.

Five checks that take ten seconds

1. The actual sender address — not the display name. "PayPal Support" can be typed by anyone; paypal-secure-billing@mail-check724.com is the truth.
2. Hover before you click. On a computer, resting your mouse on a link reveals the real destination in the corner. If the text says paypal.com but the destination is something else — that's your answer.
3. Generic greetings. "Dear customer" from a company that definitely knows your name is a flag.
4. Unexpected attachments — especially invoices you weren't expecting or files asking you to "enable content."
5. Requests no legitimate process makes: passwords by email, payment by gift card, "keep this confidential."

The one habit that defeats almost everything

Never act through the message itself. If "your bank" emails about a problem, don't click the email's button — open a new tab and log in the way you normally do, or call the number on your card. If the problem is real, it will be visible in your account. This single habit neutralizes even the most beautiful fake, because you never touch the trap.

If you already clicked

No shame — it happens to careful people. Change that account's password immediately (and anywhere you reused it), turn on two-factor login, and if money or card details are involved, call your bank now — speed matters more than embarrassment.