For years, the advice on spotting a phishing email was simple: look for the spelling mistakes, the strange logo, the sender address that didn’t quite match. That advice still has its place, but it’s no longer enough on its own. Today’s phishing emails are often written with the help of AI, which means the scruffy, obviously fake messages of a few years ago have largely been replaced by ones that read fluently, use the right tone for the business they’re impersonating, and arrive at exactly the moment you’re too busy to look twice.
This Cyber Security Awareness Month, the national theme is “Don’t Make It Easy for Them.” Phishing is the perfect place to start, because it’s still the way most cyber attacks get their foot in the door. Here are five red flags worth building into your team’s everyday habits.
1. Urgency and pressure
Phishing emails are designed to make you act before you think. “This invoice is overdue,” “your account will be suspended today,” “the director needs this transferred before 3pm” are all classic pressure tactics. A genuine, well-run business rarely needs an instant, unquestioned response. If a message is pushing you to skip your normal checks, that’s the message to slow down on, not speed up for.
2. A sender that doesn’t quite line up
Look past the display name and check the actual email address, and pay attention to the reply-to address too, not just the “from” field. A message that appears to come from a colleague or supplier but replies to a completely different domain is one of the most reliable signs something is wrong.
3. Requests to bypass the normal process
If someone asks you to change a payment method, pay by gift card, or process a request “off the usual system, just this once,” treat that as a red flag regardless of how convincing the message sounds. Attackers rely on employees not wanting to question a request that appears to come from someone senior. A quick phone call to confirm, using a number you already have on file rather than one in the email, takes a minute and closes off this entire category of attack.
4. Links and attachments that don’t match what’s expected
Hovering over a link (without clicking) will usually show you where it actually leads, and it’s worth checking before you click, especially if the email wasn’t expected. The same goes for attachments: an unexpected invoice, delivery note, or “shared document” from someone you don’t normally exchange files with is worth a second look before opening.
5. Messages designed to trigger fear or excitement
Fake missed deliveries, fake prize wins, fake HMRC or bank warnings: these all work by triggering an emotional response that overrides careful thinking. The more alarming or exciting a message feels, the more worth pausing on it is.
A new twist: AI-generated calls and voices
It’s also worth making your team aware that phishing isn’t limited to email any more. AI tools can now convincingly clone a voice from a short recording, which has led to a rise in phone calls that sound exactly like a colleague or director asking for an urgent transfer or password reset. The same principle applies: if a request is urgent, unusual, or asks you to bypass a normal process, verify it through a separate channel before acting.
What to do when something looks off
Report it, don’t just delete it. A quiet “delete and move on” means your IT team and colleagues never find out a phishing attempt is doing the rounds, and someone else in the business may not spot the same red flags you did. A quick forward to your IT support team, or use of a “report phishing” button if one is set up, takes a moment and helps protect everyone else.
How Information Solutions can help
We provide email and endpoint protection to filter out a large proportion of phishing attempts before they ever reach an inbox, and we can also run simulated phishing exercises so you can see, safely, how your team responds to a realistic attempt and where any gaps in awareness are. If you’d like to talk through either of these for your organisation, get in touch with our team.