How to spot a phishing email aimed at your business

The ones that actually show up

• A shared document or voicemail that leads to a login page that looks like Microsoft 365 or Google. Enter your password and they have your mailbox.
• An invoice or payment change from a supplier, sometimes sent from the supplier’s real, hacked account.
• “Your mailbox is full” or “your password expires today.”
• Domain and listing scams: a renewal notice from a company that isn’t your registrar, or a call or email saying your Google listing will be removed unless you pay.
• A message from “the owner” asking someone to buy gift cards or send a quick payment.

The signs

• Urgency, secrecy or a threat: today, don’t tell anyone, or your account will be closed.
• A sender address that’s slightly off, or a display name that doesn’t match the address underneath.
• A login page reached from a link in an email. Hover or long-press the link and read the real address before tapping.
• A request to change how money is paid.
• Anything you weren’t expecting, even from someone you know.

What to do

1. Don’t click, don’t replyIf it might be real, go to the service directly by typing the address, or call the sender using a number you already have.
2. Report itUse the report phishing option in Outlook or Gmail, so the provider can block it for others.
3. If someone entered a passwordChange it right away from a trusted device, sign out every session, check two-step sign-in is on, and look for new forwarding rules. Then call us or your IT provider.