DigixiteBlog
Online Security

How to Spot a Phishing Email: 12 Red Flags Most People Miss

Phishing emails have become harder to spot now that scammers use AI to write them. These 12 red flags, and a simple 'stop and verify' habit, will catch most of them.

By Digixite Editorial Team5 min read
How to Spot a Phishing Email: 12 Red Flags Most People Miss

Phishing is still the most common way small businesses get hacked. A convincing email arrives, someone clicks a link or opens an attachment, and the attacker gets a password, a bank payment or a foothold on a computer. It does not take a careless person. It takes a busy one.

The old advice to "look for spelling mistakes" no longer works well, because scammers now use AI tools to write fluent, polished messages. The red flags below focus on what is much harder to fake: the pressure, the request and the technical details.

In this article
  1. The 12 red flags
  2. The one habit that beats all of them: stop and verify
  3. What to do if you clicked
  4. Reduce the damage before it happens
  5. Summary

The 12 red flags

1. It creates urgency or fear

"Your account will be suspended in 24 hours." "Unusual sign-in detected." "Final notice." Urgency is designed to make you act before you think. Real companies rarely threaten immediate shutdowns by email.

This is the classic credential-stealing trick. The link leads to a fake login page that looks identical to the real one. The safe habit: never log in from an email link. Open the app or type the website address yourself.

3. The sender's address does not match the name

The display name says "Microsoft 365" but the actual address is something like security@m1crosoft-support.co. On mobile, tap the sender name to reveal the full address.

On a computer, hover over a link (without clicking) to see the real destination. Watch for look-alike domains: extra words (paypal-secure-login.com), swapped letters, or the real brand name buried as a subdomain (paypal.com.account-check.net — the real domain there is account-check.net).

5. It wants payment details changed

"We have changed banks — please send this month's invoice payment to our new account." This is business email compromise, and it costs businesses enormous sums each year. Always confirm bank detail changes by phone, using a number you already have, not one in the email.

6. An unexpected attachment

Invoices you were not expecting, "scanned documents", "voicemail" files and shipping notices are favourite lures. Be especially wary of compressed files (.zip), HTML attachments and Office files that ask you to "enable content" or "enable macros".

7. A shared document you did not ask for

Fake "X has shared a file with you" notifications are common because they look routine. If you were not expecting it, check with the sender through a different channel.

8. The greeting is generic — or oddly specific

"Dear customer" is a mild warning sign. But targeted phishing (spear phishing) may use your name, job title and a colleague's name, pulled from LinkedIn or your website. Personalisation does not prove an email is genuine.

9. It asks you to keep it confidential

"I'm in a meeting, can you buy gift cards for a client and send me the codes? Keep this between us." Requests for secrecy, gift cards or cryptocurrency are near-certain signs of fraud.

10. It asks for a code you just received

If anyone asks you to read back a one-time code sent to your phone, they are trying to sign in as you. No real support team needs that code.

11. It asks you to scan a QR code

"Quishing" uses QR codes to hide the link from email filters and from your mouse hover check. Treat a QR code in an unexpected email exactly like a suspicious link.

12. Something just feels off

A supplier who normally writes two lines suddenly sends a formal paragraph. Your boss emails at 3 a.m. from a personal address. Trust that feeling enough to verify.

The one habit that beats all of them: stop and verify

You cannot memorise every scam. You can adopt one rule: if an email asks you to log in, pay, change details, open something unexpected or share a code, verify it through a different channel first. Call the person on a known number. Open the app directly. Ask a colleague in person or on your team chat.

Verification takes one minute. Recovering from a compromised email account or a misdirected payment can take months.

What to do if you clicked

  1. Do not panic, and do not hide it. Speed matters more than blame. In a business, tell whoever handles IT immediately.
  2. If you entered a password, change it right away from the real website, and change it anywhere else you reused it.
  3. Sign out of all sessions on that account (most services offer this in security settings) and check for new email forwarding rules, which attackers add to watch your inbox quietly.
  4. If you opened an attachment, disconnect the device from the network and run a full security scan.
  5. If money was sent, call your bank immediately. The faster a transfer is reported, the better the chance of recovery.
  6. Report it. Use your email provider's "report phishing" option and your country's cybercrime or fraud reporting service.

Reduce the damage before it happens

  • Turn on two-step verification everywhere, ideally with an authenticator app or passkeys rather than SMS where possible. A stolen password alone is then much less useful.
  • Use a password manager. It will not autofill your password on a fake site, which is a surprisingly effective phishing alarm.
  • Set up email authentication for your domain (SPF, DKIM and DMARC) so scammers find it harder to send email pretending to be you.
  • Agree on a payment rule in your team: no bank detail changes or urgent transfers without a phone call.

Summary

Modern phishing emails can look perfect. What gives them away is what they ask you to do and how hard they push. Slow down whenever a message wants a login, a payment, a file opened or a code, and confirm it another way. That single habit stops the large majority of attacks.

phishingemail securityscamssmall business security

Keep reading