The message looks like it's from your finance lead. It's 4:52 pm, you're at the kitchen table on the work laptop, and the ask is small: confirm a bank detail change before the payment run. Nothing about it feels obviously wrong. That's the point. The clumsy, badly spelled phishing email still exists, but it's no longer the one that catches people. The ones that work borrow the tone, the signature and the timing of people you actually know.
Remote work removes your cheapest verification tool: the colleague in the next chair you can turn to and ask. You can't swivel. So the check has to happen in your head, in about fifteen seconds, before the click. Here is the list worth keeping next to the laptop.
Sender red flags
Your phone mail app shows a display name. Attackers know that, which is why they put "IT Helpdesk" or your manager's name there and a throwaway address behind it. Always expand the sender and read the actual address, character by character, on the domain.
- Close but not exact domains. An extra hyphen, a doubled letter, an "rn" standing in for "m", or a different ending: company-support.co instead of company.com. Lookalikes are cheap to register and easy to miss at a glance.
- Free mail for business requests. An invoice, a payment change or a contract arriving from a personal Gmail or Outlook address when your vendor normally uses their own domain.
- Reply-To points somewhere else. Legitimate mailing lists do this, so it isn't proof of anything on its own. A finance or HR request doing it is a different matter.
- First contact from someone who should already exist. If the "new colleague" or "external auditor" isn't in your directory, org chart or previous threads, treat the introduction as unverified.
- A sudden channel switch. The email says "message me on WhatsApp" or gives a mobile number for something that has always been handled in email or your ticketing system.
- Odd recipients. A message to a distribution list you rarely see, or one that arrives in spam and insists you move it to the inbox yourself.
Link red flags
The link text means nothing. "View document" and "Sign in to confirm" are just words an attacker types. What matters is where the link actually goes, and on desktop that means hovering without clicking. On a phone, long-press to preview the destination instead of tapping.
Read the domain from right to left
Find the first single slash after the protocol. Everything immediately before it is the real site. So in login.yourbank.com.secure-auth.example.net/portal, the site you're visiting is example.net — the words in front of it are decoration. Subdomains are free to name, and attackers use reassuring ones.
- Shortened links in work email, where you can't see the destination at all. If a colleague wants to share a file, ask for the full URL or the file itself.
- QR codes in emails or on printed notices. They push the click onto your personal phone, where your employer's protections don't apply and you can't inspect anything.
- Login pages you didn't ask for. If you didn't open the site yourself, don't type a password into it — no matter how familiar the branding looks.
- Cloud document invites from a provider your team doesn't use, or for a file you were never told about. Open it by logging in through the provider's normal address, not through the email.
- The habit that beats all of it: when you need to sign in, close the email and go to the site the way you always do — a bookmark or a typed address.
Urgency red flags
Pressure exists to shrink the window in which you might think. Deadlines measured in minutes, an account "closing today", a wire that must land before the close of business, a request to keep quiet until it's done, or a manager who is "heading into a meeting and just needs a yes".
Real emergencies do happen in real companies, so the answer isn't to ignore urgency. The answer is to treat urgency as a reason to slow down and verify on a second channel, not as a reason to skip the check. A genuine request survives a five-minute delay. Most phishing campaigns don't, because their value collapses the moment you talk to someone else.
Urgency is the attacker's substitute for authority. When you see one, go find the other.
Attachment red flags
Attachments are how a lot of modern phishing skips the link entirely. Watch for file types that execute or hide something: .exe, .scr, .js, .lnk, .iso, .img, and macro-enabled Office files such as .docm or .xlsm.
- Double extensions. invoice.pdf.exe — your mail client may hide the last part, so check the full filename.
- Password-protected archives. A zip with a password in the body of the email is designed to slip past scanners and gives the sender a friendly excuse.
- HTML attachments. These open a local page in your browser showing a fake login form. They bypass most link-based defenses, and they're common.
- Unexpected invoices, receipts or shipping notices from companies you don't have a relationship with, especially when the amounts are plausible.
- Documents that require you to "enable content" or "enable editing" to see them. That prompt is the delivery mechanism.
The fifteen-second check
- Pause. Does this ask for money, credentials, a one-time code, or a change to payment details? Those four cover most of the damage.
- Expand the sender. Full address, not display name.
- Inspect every link before clicking. Read the domain sitting just before the first single slash.
- Ask whether you expected it. A document you didn't request, from a process that doesn't normally work this way.
- Watch for the link-free version. "I've lost my phone, can you text me a code?" is account takeover with no attachment at all.
- Verify on a channel you choose. Use the number in your directory or the chat app you already share — never the contact details in the suspicious email.
- Never approve a prompt you didn't trigger. Repeated MFA pushes are someone trying to get in.
- When unsure, report and delete. Reporting costs a minute. A wrong payment does not.
If something already slipped through
Act quickly and say so. Speed matters far more than embarrassment, and most security teams would rather hear about it in five minutes than five days.
If you entered credentials, change that password from a different device, sign out of active sessions, and turn on multi-factor authentication. If you approved an MFA prompt you didn't start, treat it as account takeover in progress and do the same immediately. If you opened an attachment, disconnect from the network, stop using that machine for anything sensitive, and report it to your security contact before you keep working. If money has moved, call your bank's fraud line straight away — recalls sometimes work, but only within a short window — and loop in your finance or legal team rather than handling it alone.
Print the checklist. Keep it where the laptop lives. The goal isn't to become suspicious of every message; it's to make the fifteen-second check automatic, so the one email that's genuinely well built still has to get past your hands.
Photo: cottonbro studio / Pexels
