Phishing Emails 101: How to Spot and Avoid Them
, by Rukxi Team, 16 min reading time
Learn seven warning signs of phishing, how to verify suspicious emails safely, and what to do after clicking a link or sharing sensitive information.
Phishing emails 101: how to spot and avoid them
An email arrives claiming your bank account needs verification, a parcel can't be delivered, or your password is about to expire. It looks convincing. Before you click, here's how to tell a genuine message from a trap — and what to do if you've already clicked.
Seven warning signs to check
Sender addressFull address checked?
UrgencyDeadline pressuring you?
LinksDestination verified?
AttachmentsWere you expecting it?
PasswordsCredentials requested?
PaymentsBank details changed?
InconsistenciesContext makes sense?
A single careless click can expose personal accounts or compromise an entire business. Phishing emails rely on trust, urgency, and convincing formatting — not technical exploits. Recognising them is an everyday habit, not a one-time training exercise.
What is a phishing email?
A phishing email is a fraudulent message designed to persuade the recipient to take an action that benefits a cybercriminal. Attackers may pretend to represent a bank, delivery company, government organisation, online service provider or even the recipient's employer. The message may ask you to verify account details, reset a password, download an invoice or approve a payment.
Some emails direct recipients to fake login pages that collect passwords, while others contain attachments that may install malicious software. Phishing attacks can target large groups of people or specific individuals and businesses. In targeted attacks, criminals may use details about an employee, supplier or ongoing business transaction to make their messages appear more believable.
Not every phishing email contains obvious spelling mistakes. Some are professionally written and closely resemble genuine business communications. Check the sender, links and requests — not just the appearance. Modern phishing can be polished and personalised, including through the use of AI tools.
1
A suspicious sender address
Always check the full sender address, not just the display name shown in your inbox. A message may appear to come from a bank or familiar company while using a slightly altered domain or an unrelated email address. For example, a fraudulent message might use a domain that resembles a legitimate business name but contains an extra word, different spelling or unusual ending.
When something seems unusual, compare the address with previous legitimate correspondence or the organisation's verified contact details. A familiar display name alone does not prove the email is genuine.
2
Urgent or threatening language
Phishing messages often pressure recipients to act quickly. They may claim that an account will be suspended, a payment will fail or access will be restricted unless the recipient responds immediately. This urgency is intended to reduce the time available for careful checking. An email may also promise a reward or warn about an unexpected charge to encourage an emotional response.
Do not let a deadline in an email force you into clicking a link or sharing information. If the request concerns an important account or business transaction, verify it independently through a trusted channel. Real institutions rarely demand action within the hour.
3
Unexpected or misleading links
A link may display the name of a familiar website while directing you to a different destination. Attackers can use misspelled domains, misleading subdomains and shortened links to disguise where a link leads. On a computer, you can often hover over a link to inspect its destination before opening it. On a mobile device, use the link-preview feature where available, but avoid opening anything you cannot verify.
If an email claims that your bank account needs attention, open the bank's official app or type its known website address into your browser instead of following the email link. Never enter passwords or payment details into a website simply because an email directs you there.
4
Unexpected attachments
Invoices, receipts, delivery notices and office documents are common themes used to make malicious attachments look ordinary. An unexpected file may contain harmful software or attempt to persuade you to enable unsafe features. Be particularly cautious about attachments you were not expecting, even if the sender's name looks familiar.
If a colleague supposedly sends an unusual file, confirm the request through a separate communication channel before opening it. Never disable security protections or enable macros simply because a document instructs you to do so.
5
Requests for passwords or sensitive information
Legitimate services generally do not need you to disclose your password or one-time verification code through an email reply. Phishing messages may ask for login credentials, banking information, identity details or other confidential data. Attackers may also impersonate an IT administrator and claim they need your password to fix an account problem.
Treat such requests with caution, especially if they bypass your organisation's normal support process. Never share passwords or authentication codes in response to an unexpected email. If an account genuinely requires attention, visit the service through a trusted route and follow its official account-security process.
6
Unusual payment or invoice instructions
Businesses should be especially careful with messages requesting urgent payments, supplier bank-detail changes or transfers to a new account. Criminals may impersonate executives, suppliers or finance staff to redirect legitimate payments. Even a message within an existing email conversation may be fraudulent if an account has been compromised.
Familiar wording or a known contact name is not enough to confirm a financial request. Before making a payment or changing supplier details, verify the request through an independently established contact method, such as a known telephone number. Do not rely solely on contact information included in the suspicious message.
7
Inconsistent details or unexpected requests
Some phishing messages contain unusual greetings, incorrect company details, unexpected requests or inconsistencies between the sender, subject line and message. These details can help identify a suspicious email. However, poor grammar is not a reliable test by itself — modern phishing messages can be polished and personalised.
Focus on the overall context. Ask whether you expected the message, whether the requested action makes sense, and whether the sender can be verified independently. A well-written email about something you never asked for is still a phishing email.
Common phishing email examples
Four scenarios that appear regularly in inboxes, and what to do for each. The pattern is always the same: the message creates urgency, then offers a link or attachment as the solution.
Fake bank or payment notifications
The scenario: You receive an email claiming that an online payment has failed or your bank account has been temporarily restricted. It directs you to a link to confirm your identity or update account details.
What to do: Do not follow the email link. Open your bank's official app or contact the bank through a verified number to check whether there is a genuine issue.
Fake parcel delivery messages
The scenario: An email claims that a parcel cannot be delivered until you pay a small fee or confirm your address. The message may imitate a courier service and use a deadline to encourage immediate action.
What to do: Check the tracking information through the courier's official website or app using a tracking number you already trust. Do not provide payment details through an unverified link.
Password reset or account suspension emails
The scenario: A message claims that your password has expired or your account will be closed unless you sign in immediately. The link leads to a fraudulent login page designed to capture your credentials.
What to do: Visit the service directly through its official website or application. If you are concerned about account security, change your password through the genuine service rather than the email link.
Fake business invoices
The scenario: An employee receives an invoice from a supposed supplier or a message asking finance staff to update bank details. The request may look like part of a normal business transaction.
What to do: Confirm the invoice, payment instructions or account changes through a separate, established contact channel before transferring money or changing records.
How to check a suspicious email safely
When an email feels unusual, take a moment to examine it before responding. Check the sender's full address, consider whether the message was expected and review the requested action carefully. Inspect links without opening them, and avoid downloading unexpected attachments.
If the email claims to come from an organisation you use, verify the request through its official app, website or independently obtained contact details. Do not reply with confidential information or use telephone numbers supplied only in the suspicious message. If the email appears to target your workplace, report it through the company's approved security or IT support process.
When you are unsure, it is safer to verify the request than to risk exposing an account or business system. A genuine request can usually be confirmed without relying on the suspicious email itself.
!
What to do if you clicked a phishing link
Clicking a suspicious link does not always mean your device or account has been compromised, but you should respond carefully. The next steps depend on whether you only opened a page, downloaded a file or shared sensitive information.
If you opened the link but entered nothing
Close the suspicious page and do not download files or follow further instructions. Report the email through the appropriate channel, and follow your organisation's security guidance if the device belongs to your workplace. If a file downloaded automatically or you notice unusual device behaviour, contact IT support and use an appropriate security tool to investigate. Do not assume that closing the page alone resolves every possible risk.
If you entered your password or verification code
Use a trusted device and the service's official website or application to change the affected password as soon as possible. If you reused that password elsewhere, change it on those accounts too. Enable multi-factor authentication if it is not already active. Review recent sign-ins and account activity, and sign out other sessions or revoke access where the service provides those options. If the account belongs to your employer, notify the IT or security team immediately.
If you shared banking or payment information
Contact your bank immediately through an official number or application if you disclosed banking credentials, card information or other payment details. Follow the bank's instructions to secure the account and report any unauthorised transactions. For business payments, alert the relevant finance team and management so they can investigate and take action to prevent further losses. Preserve the suspicious email and related information if it is needed for reporting or investigation.
How businesses can protect employees from phishing
Five layers that, together, reduce both the likelihood and the impact of a phishing incident. No single layer catches every message — the goal is to make it harder to click and easier to recover.
Provide regular security awareness training
Employees should understand common phishing tactics and know how to report suspicious messages. Training can use realistic examples involving fake invoices, password resets, supplier requests and impersonation attempts. Short, regular reminders can help staff build safer habits without making cybersecurity training unnecessarily complicated. Employees should also know that reporting a suspicious message is encouraged, even when they are unsure whether it is malicious.
Use email security and antivirus tools
Email filtering can help detect and block suspicious messages, while endpoint security software can help protect devices against certain malicious files and activities. These tools provide valuable layers of defence, but no single product catches every phishing attempt. Businesses should keep security software updated and configure email protections appropriately — and ensure employees know how to report messages that reach their inbox despite these controls.
Enable multi-factor authentication
Multi-factor authentication adds another verification step when someone signs in. It can reduce the risk of account compromise when a password is stolen, although it does not eliminate every threat. Businesses should prioritise important email, administrator and financial accounts. Employees should never approve an unexpected sign-in request or share a one-time authentication code with someone who contacts them by email or phone.
Keep software and devices updated
Security updates help address known weaknesses in operating systems, browsers, applications and other software. Businesses should establish a regular update process rather than leaving important devices unpatched indefinitely. Updates work best as part of a broader security approach that includes reliable backups, appropriate access controls and clear incident-reporting procedures. Employees should also avoid installing unapproved applications or disabling security protections to complete an unexpected request.
Establish a clear reporting process
Employees need to know exactly how to report suspected phishing. Depending on the organisation, this might involve an email-reporting button, a dedicated IT address or an established support process. A quick reporting process allows the organisation to investigate messages, warn other employees and take action where necessary. Businesses should also explain what employees should do if they accidentally click a link or share information, so that incidents can be reported promptly without fear of blame.
Your anti-phishing checklist
Seven habits that catch most phishing emails. Save this list and share it with your team.
- Check the full sender address, not just the display name
- Hover over links before clicking — verify the destination
- Don't let urgency or threats force a quick decision
- Confirm unexpected attachments through a separate channel
- Never share passwords or codes by email reply
- Verify payment or bank-detail changes by known phone number
- Report suspicious messages through your organisation's process
Frequently asked questions
What is the easiest way to identify a phishing email?
Start by checking the full sender address, unexpected requests, suspicious links and unusual pressure to act quickly. Verify important requests independently rather than relying on the email's appearance, since convincing phishing messages may contain few obvious mistakes.
Can a phishing email look completely legitimate?
Yes. Attackers can imitate real organisations, use convincing branding and write polished messages. Some also use compromised accounts or personal information to make their emails more believable. Always verify unexpected requests involving credentials, payments or sensitive data.
Can antivirus software stop all phishing emails?
No. Antivirus and email security tools can block or detect many threats, but some phishing messages may still reach the inbox. Users should combine security software with careful verification, multi-factor authentication, software updates and a clear reporting process.
What should I do if I receive a phishing email at work?
Do not click links, open unexpected attachments or reply with sensitive information. Report the message through your organisation's approved security or IT support process. If you have already interacted with it, explain exactly what happened so the team can respond appropriately.
The bottom line
Phishing emails often rely on trust, urgency and convincing messages to persuade people to take unsafe actions. Recognising suspicious sender addresses, checking links carefully and verifying unexpected requests can help individuals and businesses avoid common traps. For Sri Lankan businesses, phishing awareness should be part of everyday cybersecurity rather than a one-time training exercise.
Email filtering, antivirus protection, multi-factor authentication, regular updates and clear reporting procedures all contribute to a stronger defence. The most important habit is simple: pause before acting on an unexpected email. When a message requests money, passwords or sensitive information, verify it through a trusted channel before proceeding.
Received a suspicious email today?
Don't click — report it through your organisation's process, then share this checklist with someone who needs it.
Related articles
-
, by Rukxi Team Is AI Replacing IT Support? What Small Businesses in Sri Lanka Need to Know
-
, by Rukxi Team PANTUM PD-401W Barcode Label Printer: Features, Benefits and Business Uses
-
, by Rukxi Team 12 Windows Keyboard Shortcuts You're Probably Not Using
