Spotting Phishing Emails

Phishing is when a scammer pretends to be someone you trust, such as your bank, your boss, a supplier or a government agency, to trick you into clicking a link, opening an attachment, sending money or giving up a password. It’s the most common way accounts get hacked and businesses lose money. The good news: most phishing has warning signs you can learn to spot.

Everyone
Small businesses
Office & field staff

Photo: phishing email on a phone with the red flags circled: fake sender, urgent subject, mismatched link

Red flags

Urgency or threats: “Your account will be closed today,” “Payment overdue,” “Final notice”
A sender that doesn’t match: the name says your bank, but the address is a random Gmail account or a misspelled company name (rnicrosoft.com instead of microsoft.com)
Links that don’t go where they say: on a computer, hover over the link to see the real address. On a phone, press and hold.
Unexpected attachments, especially invoices, shipping notices, voicemails or “scanned documents” you weren’t expecting
Requests for passwords, codes or personal information. Real companies don’t ask for your password or one-time code by email or text.
Unusual payment requests: gift cards, wire transfers, cryptocurrency or payment apps
Changes to banking details: “We changed banks, please send future payments to this account”
Too good to be true: prizes, refunds, free equipment, a job offer you didn’t apply for
Generic greetings like “Dear customer,” and odd spelling or grammar (though AI tools now make scams look polished)

Scams aimed at contractors and workers

Scam	How it works
Fake invoices	An email that looks like it’s from a supplier or subcontractor asks you to pay an invoice, often with a link or attachment.
Changed bank account (business email compromise)	A scammer hacks or imitates a real vendor’s email and asks you to send the next progress payment to a new account. Contractors and title companies have lost hundreds of thousands of dollars this way.
Payroll direct deposit change	“Please update my direct deposit” emails sent to HR or the office, pretending to be an employee.
Boss or owner impersonation	“I’m in a meeting, buy gift cards for the crew and text me the codes.”
Fake government notices	Emails claiming to be from OSHA, the IRS, the state licensing board or the DMV, demanding payment or personal information.
Fake bid invitations and plans	“You’re invited to bid, click here to view the plans” leads to a fake login page that steals your password.
Fake job offers	High-paying jobs that require you to pay for training, equipment or background checks, or that ask for your Social Security number up front.
Delivery and toll texts	Texts about a missed package or unpaid toll with a link to “pay a small fee.”

Before you click, pay or reply

Slow down. Scammers want you to act fast. Take a breath.
Check the sender’s real address, not just the display name.
Don’t use the links or phone numbers in the message. Go to the company’s website yourself, or use the app or a phone number you already know.
Verify payment changes by phone. Call the vendor or person at a number you already have, not the one in the email, before changing any banking information or sending money.
When in doubt, ask your office manager, IT person or a coworker.

If you clicked or replied

Don’t panic, but act fast.
If you entered a password, change it right away from a device you trust, and change it anywhere else you used the same password.
Turn on two-factor authentication for the account if it isn’t already on.
If you opened an attachment or downloaded something, disconnect from the internet and run a security scan. At work, tell IT immediately.
If you sent money, call your bank right away and ask them to stop or reverse the payment. Speed matters with wire transfers.
If you gave personal information like your Social Security number, consider freezing your credit and watch your accounts. Visit IdentityTheft.gov.
Tell your employer if it was a work account or work money.

Where to report it

Forward phishing emails to reportphishing@apwg.org (the Anti-Phishing Working Group).
Forward scam texts to 7726 (SPAM).
Report scams to the Federal Trade Commission at ReportFraud.ftc.gov.
Report losses from cybercrime, including business email compromise, to the FBI’s Internet Crime Complaint Center at ic3.gov.
Report it to the company being impersonated, and use your email program’s “Report phishing” button.

Protect yourself before it happens

Use two-factor authentication (or passkeys) on email, banking and work accounts.
Use a different strong password for every account, kept in a password manager.
Keep your phone, computer and apps updated.
For businesses: require a phone call to a known number before any change to payment instructions, and require two people to approve large payments.
Be careful with QR codes on flyers, parking meters and emails. They can lead to fake sites too.
Talk about scams at toolbox talks and office meetings. People who know the tricks are much harder to fool.

Tip: Scammers can fake caller ID, email names and even voices using AI. A real request will still be real after you hang up and call back at a number you know.

Video: spot the phishing email, with real-world examples and the red flags explained

Standards & references

Last updated: October 1, 2026