- Who is it really from? Tap or hover the sender's name to reveal the address. Look for look-alike domains (an extra word, a swapped letter, a .co instead of .com), a free address claiming to be a company, or a colleague's name on an unfamiliar address.
- What does it want? Phishing almost always asks for one of five things: a password or sign-in, money or a gift card, a change of bank details, an attachment to open, or urgency and secrecy ("today", "do not tell anyone", "your account will be closed").
- Where do the links go? On a computer, hover over a link and read the address in the corner of the window. On a phone, press and hold the link to preview it. A Microsoft notice that leads to a domain you have never seen, or a shortened link, is the giveaway.
- Did you expect it? An invoice from a supplier you do not use, a voicemail you never get by email, a shared document from someone who does not share documents, a delivery you did not order.
- Does it break a normal pattern? A supplier changing bank details by email, the boss asking for something unusual and urgent, Microsoft or Google asking you to verify your account through a link. Real companies and real bosses do not work that way.
How to tell if an email is phishing, and what to do with it
A 30-second check that works in Outlook and Gmail, the disguises doing the rounds right now, the one-click way to report a message, and what to do in the first hour if you already clicked.
7 minute readUpdated
The short answer
Look at three things: who really sent it (tap the name to see the address), what it wants (urgency, money, a password, a bank detail change), and where the links go (hover on a computer, long-press on a phone). If any of the three feels off, do not click or reply. Report it with the Report button in Outlook or the Report phishing option in Gmail, then verify by another route, such as a phone call to a number you already have. If you already clicked, change your password now and tell IT within the hour. Nobody will blame you; speed is what matters.
The 30-second check
Disguises doing the rounds
| It looks like | What it really is | The tell |
|---|---|---|
| Your password expires today, or a new voicemail or shared document | A fake Microsoft 365 or Google sign-in page that steals your password and your approval code | The link does not go to microsoft.com or google.com, and real notices never need a password through a link |
| A supplier's invoice with new bank details | Business email compromise, often from the supplier's real but hijacked mailbox | Any change of payment details, however polite. Call the supplier on a number you already have |
| A parcel, customs or toll fee notice | A small payment page that harvests your card | You were not expecting anything, and the link is not the carrier's domain |
| A PDF with a QR code to scan | A link hidden where filters cannot read it | Nobody sends a QR code when a link would do |
| HR or payroll: updated salary document, benefits enrolment | A sign-in page or an attachment with a payload | Sent outside the usual HR channel, with urgency |
| A text or WhatsApp from the CEO asking for a quick favour | A gift card or transfer scam | A new number, and the boss never texts you for that |
| A flood of Authenticator prompts you did not start | Someone has your password and is hoping you tap Approve | Deny every prompt, change your password, tell IT today |
What to do with a suspicious email
- Do not click, reply or forward it to colleagues. Forwarding spreads the risk and strips the evidence IT needs.
- Report it from Outlook. Select the message, choose Report in the toolbar, then Report phishing. The same button exists in Outlook on the web, the new Outlook for Windows, Outlook for Mac and the iPhone and Android apps, as long as your company has turned it on. The message is removed and a copy goes to your IT team and to Microsoft.
- Report it from Gmail. Open the message, click the three dots next to Reply, and choose Report phishing. In the Gmail app, use the three dots at the top right of the message. Google receives a copy and your Workspace admin can see the report.
- Verify by another route. If the message claims to be from a supplier, a colleague or your bank, call a number you already have or walk over. Never use the phone number or reply address in the message.
- If you clicked or typed a password, act within the hour. Change your password from a device you trust, approve no Authenticator prompts you did not start, and tell IT straight away. If you opened an attachment, disconnect from Wi-Fi and call. If money was involved, call the supplier and your bank the same day; recall windows are measured in hours.
People who report quickly are the best defence a small company has. A good IT team will thank you for a false alarm and never make you feel foolish for a real one.
For the person who runs IT
Five settings do most of the work. None of them cost extra on Microsoft 365 Business Premium or Google Workspace Business plans:
| Setting | Where | What it does |
|---|---|---|
| Turn on the Report button and a reporting mailbox | Microsoft Defender portal, Settings, Email and collaboration, User reported settings | One-click reporting from every Outlook, with copies to you and to Microsoft |
| DMARC at reject for your own domain | Your DNS, after SPF and DKIM are in place | Stops attackers sending mail that looks like it came from your company |
| External sender tagging | Exchange Online external tagging; Gmail shows external banners by default | A visible label on every message from outside the company |
| Link and attachment scanning | Defender for Office 365 Safe Links and Safe Attachments; Gmail's enhanced pre-delivery scanning | Rewrites and checks links at the moment of the click, detonates attachments first |
| Block automatic forwarding to outside addresses | Exchange Online outbound spam policy; Gmail routing settings | Removes the attacker's favourite way to read a mailbox quietly |
Then run a short phishing simulation twice a year with a ten-minute debrief, and require multifactor authentication with number matching so a stolen password alone is useless.
FAQ
Questions people ask
Short answers to what founders and finance leads ask us most.
Ask us something elseYes. If their account was compromised, the message comes from the real mailbox and passes every technical check. The content is the tell: an unusual request, urgency, a link to sign in. Call them.
Use the Report button instead. It sends IT the original message with the hidden headers intact and removes it from your inbox. Forwarding loses that evidence and can spread the link.
Junk is unwanted advertising; reporting it moves the message to Junk and blocks the sender. Phishing is an attempt to steal something; reporting it deletes the message and sends a copy to your security team and to Microsoft or Google.
Usually, but tell IT anyway. Some pages attempt to install something on the click, and IT can check the device and the sign-in logs in minutes.
No. Real notices send you to sign in at the usual place, never through a link that asks for your password and approval code.
Nothing bad. Your IT team sees the report, marks it as not a threat, and the sender is not affected. Reporting too much is far better than reporting too little.
How SF3 Technologies helps
We turn on reporting, link and attachment scanning and external tagging in your Microsoft 365 or Google Workspace, lock your own domain with DMARC so it cannot be impersonated, train your team with short simulations, and take every reported message off their hands. All of it runs inside your own tenant, with dedicated admin accounts.
Button names in Outlook and Gmail change from time to time. Steps checked in October 2026 against Microsoft and Google documentation.