Blog / Cybersecurity

10 Signs of a Phishing Email Every Employee Should Know

Learn the ten warning signs of phishing emails, what to do if someone clicks a bad link, and how to build simple habits that protect your whole team.

One Solutions Team · · 5 min read

Phishing emails are one of the most common ways attackers get into a business, and they only need one person to click. Learning how to spot phishing emails is a skill every employee can build in a few minutes, and it pays off every single day. Here are ten warning signs to watch for, what to do if someone takes the bait, and simple habits that protect your whole team.

Why Phishing Still Works

Phishing works because it targets people, not technology. A convincing message arrives at a busy moment, looks like it came from someone familiar, and asks for something that seems routine. Attackers use phishing to steal passwords, trick staff into sending payments, and install ransomware.

Government agencies like the FTC and CISA consistently list phishing among the top threats to individuals and organizations, and small businesses are frequent targets because they often have fewer security layers than large companies.

10 Signs of a Phishing Email

No single sign proves an email is malicious, but the more of these you see, the more careful you should be.

1. Urgency or Pressure

"Your account will be closed in 24 hours." "Wire this today before the deal falls through." Attackers create time pressure so you act before you think.

2. A Sender Address That Does Not Quite Match

The display name may say your CEO or a well-known vendor, but the actual address is a free email account or a domain with a small misspelling, like an extra letter or swapped characters. Always look at the full address, not just the name.

Hover over a link before clicking (or press and hold on a phone) to see where it really leads. If the text says one company but the link points to an unfamiliar domain, do not click.

4. Unexpected Attachments

Be cautious with attachments you were not expecting, especially invoices, shipping notices, voicemail files, or documents that ask you to "enable content" or "enable macros."

5. Requests for Passwords or Login Codes

Legitimate IT teams and service providers do not ask you to send your password by email. Be especially wary of messages asking you to "verify" your account or share a multi-factor authentication code.

6. Changes to Payment Details

A vendor suddenly has a new bank account, or an executive asks for gift cards or an urgent wire transfer. This is the classic business email compromise scam, and it can be very costly.

7. Generic Greetings

"Dear customer" or "Dear user" from a company that normally addresses you by name is a red flag, although targeted attacks may use your real name.

8. Spelling, Grammar, or Formatting Oddities

Awkward wording, strange formatting, or logos that look slightly off can signal a fake. Be aware that modern phishing is often polished, so good grammar does not prove a message is safe.

9. Too Good to Be True

Prize notices, refunds you did not request, or unexpected job offers are common lures.

10. Something Just Feels Off

Trust your instincts. If a message from a coworker reads differently than usual, arrives at an odd time, or asks for something unusual, verify it before acting.

Key takeaway: When an email asks you to click, pay, or log in, pause and verify through a separate channel you already trust, such as a known phone number.

What to Do If You Spot One

If you think an email is phishing:

  • Do not click links, open attachments, or reply.
  • Report it using your email's report button or by forwarding it to your IT support team, following their instructions.
  • Delete it after reporting.
  • If it appears to come from a coworker or vendor, contact them by phone or a known channel to warn them.

Reporting matters even when you did not fall for it. Someone else in the office may have received the same message.

What to Do If Someone Clicks

Mistakes happen, and the worst response is staying quiet out of embarrassment. Speed matters far more than blame. If someone clicks a link, opens an attachment, or enters a password:

  1. Disconnect the device from the network if malware may be involved, by unplugging the network cable or turning off Wi-Fi.
  2. Contact IT support right away and explain exactly what happened.
  3. Change the password for any account that was entered, and any other account using the same password.
  4. Watch for unusual activity, such as unexpected password reset emails or sent messages you did not write.
  5. If money was sent, contact your bank immediately, since quick action sometimes allows a transfer to be stopped or recovered.

Businesses can also report fraud to the FBI's Internet Crime Complaint Center (IC3) and phishing to the FTC.

Simple Habits That Protect Your Team

Technology helps, but habits make the biggest difference. Encourage everyone to:

  • Verify any payment or bank detail change by phone using a number already on file
  • Use multi-factor authentication on email and important accounts
  • Use a password manager and unique passwords for every account
  • Keep software and browsers updated
  • Slow down on emails that create urgency
  • Report suspicious messages without fear of getting in trouble

Short, regular reminders work better than a single annual training session. Sharing real examples of phishing emails your office has received is one of the most effective ways to keep people alert.

Technical Safeguards That Help

Good email security reduces how many phishing messages reach inboxes in the first place:

  • Spam and malware filtering on your email system
  • Email authentication records (SPF, DKIM, and DMARC) for your domain to make spoofing harder
  • External email warning banners
  • Endpoint protection on every computer
  • Regular, tested backups so a ransomware infection is recoverable

If ransomware does get through, your backups become your safety net. Our guide to the 3-2-1 backup rule explains how to make sure they will work when you need them.

Getting Help From One Solutions

At One Solutions, security is part of everyday managed IT support for businesses in Vienna, Tysons, McLean, Fairfax, Reston, Arlington, Falls Church, and Washington, DC. We monitor systems 24/7, respond to every service request within one hour, and offer telephone support 7 days a week, so when an employee is unsure about an email, they have someone to call.

If you would like help tightening your email security or deciding what to do after a suspicious click, call us at (703) 263-8500 or get in touch.