How to Spot a Phishing Email Before You Click

Small businesses are common phishing targets — smaller teams, less formal process, and often less time to double-check an urgent-looking request. A few habits catch most attempts before they cause damage.

Check these before you click, reply or pay

Sender address, not just the display name: a display name can say “Oelof” while the real address is unrelated — always check the actual address.
Urgency and pressure: “pay this today,” “don't tell anyone,” “I'm in a meeting, just action this” are classic pressure tactics.
Unexpected invoices or bank-detail changes: always confirm a changed bank account by phone, on a number you already have — never one in the email.
Links that don't match the text: hover (or long-press on mobile) before clicking to see where a link actually goes.
Unexpected attachments, especially ZIP files or documents asking you to “enable macros.”
Spoofed “boss” requests: a request that bypasses your normal approval process is worth a second, separate channel to confirm.

If you're not sure

Don't click, don't reply, and don't forward it to “see what others think.” Confirm with the sender through a separate channel (phone call, different app) and, if it's a business account, report it so other staff get warned too.

Endpoint protection and email filtering reduce how many of these reach your inbox in the first place — see Emsisoft Antivirus. Unsure whether a specific email is safe? WhatsApp us a screenshot and we'll take a look.