How to recognize phishing emails, what to do immediately if you receive one, and what to do if you accidentally clicked a link.
Phishing emails are fraudulent messages designed to trick you into revealing credentials, clicking malicious links, or downloading malware. They're the #1 vector for business email compromise and ransomware — and they're getting more convincing every year.
How to Recognize a Phishing Email
- Urgency and pressure: "Your account will be suspended in 24 hours." Legitimate companies don't make urgent threats via email.
- Mismatched sender address: The display name says "Microsoft" but the actual email address is from a random domain. Always check the full email address, not just the name.
- Suspicious links: Hover over any link (don't click) and look at the actual URL. If it doesn't match the supposed sender's domain, it's suspicious.
- Unexpected attachments: Be extremely cautious with attachments you weren't expecting, especially .zip, .exe, .doc, .xls, or PDF files asking you to enable macros.
- Requests for credentials or payment: No legitimate vendor will ask you to confirm your password via email.
If You Receive a Suspicious Email
- Do not click any links or open any attachments.
- Forward the email as an attachment to [email protected] for analysis.
- Report it as phishing using Outlook's built-in "Report" button (this helps Microsoft improve filtering for all users).
- Delete the email after reporting.
If You Already Clicked a Link
Do not wait and hope nothing happens. Call (925) 365-9811 immediately and tell our team what happened — which link you clicked, whether any site asked for your credentials, and whether you downloaded anything. The sooner we know, the sooner we can contain any potential compromise. Do not be embarrassed — phishing attacks fool security professionals too. Acting quickly is what matters.