How to Spot Phishing Emails: 9 Warning Signs for Staff and a Control Plan for the Organisation

A phishing email is a message that impersonates a trusted person or organisation to obtain a password, payment or file. You can spot one by a display name that doesn't match the sender address, replies routed elsewhere, links that lead somewhere other than their text suggests, and pressure to act fast. When two signs appear together, verify through an independent channel first.

Key takeaways

• Phishing emails most often give themselves away through a display name that doesn't match the address, a different Reply-To, misleading links and pressure to act fast.
• No single sign is proof; when two appear together, confirm the request through an independent channel such as a phone number you already hold.
• According to ENISA's Threat Landscape 2025, phishing was the initial intrusion vector in about 60% of the incidents analysed in Europe.
• Passing SPF, DKIM and DMARC does not make an email safe; an attacker writing from their own lookalike domain passes all three.
• Organisations should not rely on staff attention alone: domain protection, automatic inbound checks, second approval for payments and short, frequent training work together.

Why phishing is harder to recognise today

A few years ago, phishing emails gave themselves away with clumsy grammar, the wrong logo and a subject line like "Your account will be closed". Today's version is usually well written, uses the vocabulary of your sector and may even carry the signature block of a supplier you know. Keeping your own signatures standard makes an imitation easier for staff to notice; see corporate email signature management. Attackers study your website and social media to learn who does what, then send invoices to accounts, CVs to HR and quotes to purchasing.

Generative AI is a large part of this rise in the quality of phishing emails. ENISA's Threat Landscape 2025 cites reports that over 80% of phishing emails identified between September 2024 and February 2025 used AI to some extent. "Bad spelling means it's fake" is no longer a reliable rule.

The reality for most staff is that dozens of emails arrive each day, and most are read and decided on within seconds. Phishing attacks are built for exactly that habit.

What does an unnoticed phishing email cost an organisation?

Phishing remains the most common starting point for cyber attacks. Dismissing it as "someone clicked the wrong link" misses where the damage builds up: a stolen password opens the mailbox, and the mailbox opens customer correspondence, invoices and the password-reset links for every other system.

According to ENISA's Threat Landscape 2025, phishing (including vishing, malspam and malvertising) was the leading initial intrusion vector in the incidents analysed in Europe, at about 60%.

• The FBI IC3 2025 Internet Crime Report shows that phishing/spoofing was the most-reported crime type in the US in 2025, with 191,561 complaints.
• The UK government's Cyber Security Breaches Survey 2025/2026 found that 43% of businesses experienced a cyber breach or attack in the previous 12 months, with phishing by far the most common type (38% of businesses).

Türkiye is no exception. According to the Ministry of Transport and Infrastructure's January 2025 announcement, USOM, the national computer emergency response team, blocked 991 phishing domains and prevented 5,869 phishing attacks in that month alone. For companies operating in Türkiye there is also a legal angle: if a compromised mailbox holds personal data, the breach-notification duty under KVKK (Law No. 6698 on the Protection of Personal Data, Türkiye's equivalent of GDPR) may apply, so phishing belongs in your data protection compliance planning as well as your IT plan.

How to spot phishing emails: 9 warning signs

Use the nine phishing warning signs below as a checklist. None of them means "definitely fake" on its own, but two together are a reason to stop and verify.

1. The display name and the real address don't match. A message showing "John Smith – Managing Director" but sent from a free webmail account or an unfamiliar domain deserves suspicion. Mobile apps often show only the display name, so open the full address.
2. The domain looks familiar but is one character off. company.com becomes cornpany.com, company-uk.com or a version written with Cyrillic letters that look identical. We explain this technique in detail in our article on lookalike domain attacks.
3. Replies go to a different address. The message appears to come from the right sender, but when you press "Reply" a different address appears in the To field. The conversation is being diverted to the attacker.
4. The link text and the destination differ. Hover over "View invoice" (or long-press on mobile). If the real address is not the domain you expect, don't click.
5. An unexpected attachment, especially a risky type. Password-protected archives, office documents asking you to enable macros, or double extensions such as "invoice.pdf.exe". An unexpected attachment needs checking even from a familiar sender; which file types are risky and why is explained in malicious email attachments. The accounts-specific signs of invoice-themed mail are in our fake invoice email scams checklist.
6. Pressure of urgency and secrecy. "By 3 pm today", "Keep this between us, I'm in a meeting". These phrases are designed to make you skip the check, and they are the core tactic of CEO fraud emails demanding urgent payment.
7. A request outside the normal routine. Passwords, verification codes, gift cards, changes to bank details, or payments that bypass the usual approval. We cover the last case in our guide to bank detail change email fraud.
8. Brand impersonation. Emails styled as a courier, bank, government portal or cloud service, with the right logo but a login page on a different domain.
9. Failed authentication results. A failed SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail) or DMARC check in the message headers is a strong warning. The reverse is not a guarantee: an attacker writing from their own domain passes these checks. See SPF, DKIM and DMARC explained.

What to do when a message looks suspicious

The last row of the table, what to do after clicking, matters most. With phishing, damage usually grows in the hours after the click, and the employee who reports quickly protects the organisation most. That is why reporting should be rewarded, never punished. If a password was entered, the first hours are set out step by step in what to do when an email account is compromised.

Which controls should organisations put in place against phishing?

Phishing awareness training is necessary but not enough on its own. Expecting a team that reads hundreds of messages a day to run nine checks on each one is unrealistic. An effective organisation-level control plan spreads the work across five steps:

1. Protect your own domain. Configure SPF, DKIM and DMARC correctly and move DMARC in stages to p=quarantine or p=reject. This makes it much harder to send fake mail in your name.
2. Assess inbound mail automatically. Besides authentication, software should check every message for lookalike domains, display-name impersonation, Reply-To mismatches and inconsistent links.
3. Tie critical actions to a process. Payments, bank-detail changes and official replies sent on behalf of the organisation should need a second approval and leave a record. We show how to build this into email in the email approval workflow article.
4. Protect accounts. A sound password policy, visibility of active sessions, and the ability to end a suspicious session remotely. More on the password side in business password security.
5. Train briefly and often. Short, frequent sessions with real examples work better than one long annual presentation, and everyone should know how to report.

Test your phishing control plan against the scenarios of your own sector. In a freight business the attacker poses as an agent and tries to change a freight payment or a delivery instruction; we walk through that flow in logistics email fraud. For firms that bid for contracts, the target is the last-day "specification changed" email or the bid file itself; the controls are in our tender email security guide.

How does Digital Bridge approach phishing risk?

Within its cyber security consultancy, Digital Bridge treats phishing risk as a process rather than a checklist:

• We map where you stand. We review the SPF, DKIM and DMARC records of your domains, how your current email platform assesses inbound mail, and who has access to shared addresses.
• We identify the risky workflows. With the teams phishing targets most (finance, purchasing and HR), we walk through how payment and information requests are handled today.
• We deliver practical awareness training. Using examples from your own sector, we cover the nine phishing signs in this article and the reporting steps.
• We put the technical layer in place. Where needed, we move your business email to a platform that evaluates phishing signals on every message, planning the switch through our cloud migration and infrastructure consultancy. Our guide on how to choose business email sets out what to look for.

The aim of this approach is to make staff attention the second line of defence and hand the first line to software. For the basic controls beyond email, the SME cyber security checklist is a good starting point; every type of email fraud we cover is gathered in our Business Email & Documents guide.

How SmartMail evaluates phishing signals

SmartMail, the business email product in the Smart360 family developed by Digital Bridge, runs most of the checks in the nine-sign list on every inbound message, automatically. Each message goes through three groups of checks:

A concrete scenario: your accounts team receives a message with the display name "Managing Director", sent from a domain one letter away from yours, with replies routed to a third address. SmartMail does not just score it; it shows the result as a written assessment with the reasons: the display name impersonates an executive, the domain imitates yours, the Reply-To differs.

If the message falls below the trust threshold your organisation sets, it does not reach the inbox; it is quarantined rather than deleted. The company administrator sets the threshold, and the messages a new threshold would affect are listed before it is saved. Who reviews and releases quarantined mail is set out in our email quarantine policy guide.

A few more SmartMail details make a practical difference against phishing:

• Remote image protection: images inside a message are not loaded until you allow them, so tracking pixels cannot tell the sender you opened it.
• Core checks independent of AI: authentication and domain checks are run by software and keep working even if the AI usage allowance runs out.
• Account security: Smart360 Security uses human verification on sign-in screens, stopping password-guessing attacks before they reach the server. Sessions are listed with device details and can be ended remotely; changing a password closes every session.
• An audit trail in shared mailboxes: each message's activity log shows who read, labelled, annotated and replied to it, and team notes and "flag for attention" let you point a colleague to a suspicious email.

Next step

The quickest win against phishing is to review your domain's authentication records together with the workflows of the teams attackers target most. You can book a short assessment with our cyber security team, explore SmartMail's security analysis on the SmartMail product page, or contact us for a live demonstration using your own domain. To buy SmartMail, use the Smart360 purchase page.