12 Phishing Email Warning Signs Every Employee Should Know

Your finance director gets an email from the CEO asking for an urgent wire transfer. The display name says "Marc Delvaux, CEO." The signature is perfect. The thread even has the previous three messages in it. Everything looks right, except one thing: the reply-to address ends in @company-group.co instead of @company-group.com. That single missing letter is the whole attack.

Phishing email warning signs every employee should know aren't the typos and broken logos we were trained on five years ago. The attacks that actually get through in 2026 look cleaner than legitimate mail. I've sat through enough incident reviews to know that the red flags have moved — they're now buried in headers, domains, and context instead of grammar.

What are common warning signs of phishing emails?

The honest answer: the sign that matters most is context, not appearance. A message can have flawless grammar, a real logo, and a plausible sender — and still be hostile. What gives it away is whether the request fits what that person would normally ask you to do, at that moment, through that channel.

I learned this the hard way. Early in my career I flagged a clumsy email full of typos and felt clever. The real breach that quarter came from a message with perfect formatting that asked me to re-authenticate to a shared drive. I clicked. Nothing exploded — our IT team caught the credential use within the hour — but I spent a week feeling like an idiot.

The signals that still hold up

• A request that bypasses your normal process ("skip the ticket, just send it to me directly").
• Pressure with a deadline measured in minutes, not days.
• An address that is almost right — a swapped letter, an added word, a different top-level domain.
• A link whose visible text and actual destination don't match.
• An unexpected attachment, especially archives or files that ask you to enable macros.

None of these alone proves anything. Two or three together, though, and you should stop and verify through a separate channel.

What are 7 signs of phishing?

People ask me for a fixed list — the sort of thing you could pin above a desk. A numbered list is useful because it gives you something to scan for quickly. Here's the one I actually use when reviewing suspicious messages with colleagues.

1. Sender address doesn't match the display name. The name field is free text. Anyone can type "IT Support." Look at the full address, not the label.
2. Reply-to differs from the from address. This is a quiet trick — you reply, and the answer goes somewhere else entirely.
3. Link destination doesn't match the text. Hover over it. If the anchor says your bank and the URL says something else, you have your answer.
4. Urgency combined with a sensitive request. Credentials, payments, gift cards, MFA codes, file downloads.
5. Unexpected thread. A real conversation you didn't start, or a reply to a message you never sent.
6. Attachments you weren't expecting. Particularly invoices, shipping notices, and "scanned documents."
7. Small inconsistencies in tone or signature. A colleague who suddenly writes formally, or a supplier whose usual closing line is missing.

Seven is a useful number for memory, but don't treat it as a checklist where you need all seven. One strong indicator — a mismatched domain on a payment request — is enough to stop and verify.

What is the common red flag in phishing emails?

If I had to name a single one, it would be the mismatch between the identity claimed and the identity verified. The sender claims to be your CEO, but the domain is a lookalike. The link claims to be your intranet, but the URL points elsewhere. The request claims to come from a known process, but it asks you to skip that process.

That gap is where the whole attack lives. Train your eye on it and most phishing falls apart on inspection.

Subtle signs of advanced phishing attacks

The messages that catch experienced people are the ones that use real infrastructure. Two techniques in particular have become common, and neither is obvious from a quick glance.

Thread hijacking

An attacker compromises one mailbox, then replies inside an existing conversation. The recipient sees a familiar thread, a familiar tone, and a link that "continues the discussion." This defeats the "don't trust strangers" instinct entirely, because the sender isn't a stranger. I've seen this land inside finance teams twice, both times during a busy quarter close. The context does the work for the attacker.

Quishing and QR codes

A QR code in a PDF or email body moves the actual URL off your screen and onto your phone. Your laptop's URL preview is useless. This matters because most security tooling inspects the desktop path, not the camera on your phone. If a message asks you to "scan to view your document," be skeptical — especially if the code came unsolicited.

Lookalike domains

Typosquatting is old, but the execution is now precise. Watch for character substitutions that read identically at a glance:

Legitimate domain	Lookalike variant	What changed
microsoft.com	micros0ft.com	Letter "o" replaced by digit zero
yourcompany.com	yourcompany.co	Different top-level domain
paypal.com	paypal-secure.com	Added hyphenated word
company-support.com	company.support.com	Subdomain used to fake the real domain

The last row is the one people miss. Reading right to left, the real domain is support.com — the "company" part is just a subdomain the attacker controls.

What should you do if you receive a phishing email?

Look, the correct answer is boring: don't click, don't reply, report it through your internal channel. The interesting part is why each of those matters and in what order.

Do not forward it

Forwarding looks helpful and is often the wrong move. If you forward a suspicious message to a colleague, you spread the payload. Some mail systems also treat forwarded suspicious mail as a new delivery event, which can trigger alerts and confuse the investigation. Use the "Report Phishing" button if you have one — it strips the message and sends it to the right team intact.

If you already clicked

Report immediately. Not in an hour, not after you've tried to clean up. The first minutes determine whether an attacker can move laterally. In my experience, the teams that contain incidents fastest are the ones where people feel safe admitting a mistake quickly. The ones that suffer are the ones with a culture of blame, where people stay quiet and hope it wasn't serious.

Do not verify a link by clicking on it

This one deserves a blunt answer, because it comes up constantly. You should never click a link to check whether it works. Do not test a URL by opening it "just to see." If the link is malicious, the click itself can register your address, drop a payload, or confirm to the attacker that the mailbox is live and monitored.

Hover over the link instead. On a touch device, long-press. If you're still unsure, ask IT to inspect the raw header. There is no scenario where clicking is the safe verification method.

Phishing email recipients may be unfamiliar: true or false?

True. That's the point. Many phishing campaigns deliberately target people who don't know the sender — new hires, external partners, suppliers you've never met. Familiarity is not a safety signal, and unfamiliarity is not proof of malice. What matters is whether the request matches a legitimate need and a verifiable identity.

How to verify a suspicious email without being a security expert

You don't need to read raw headers or understand DMARC alignment. You need a routine that takes thirty seconds and works every time.

• Read the address, not the name. Slow down on the part after the @.
• Hover before you click. Compare the destination to what the text claims.
• Ask: did I expect this? If not, treat unexpected requests as unverified.
• Verify out of band. Call or message the person through a channel you already trust — not the one that just wrote to you.
• When in doubt, report. A false alarm costs nothing. A missed report can cost a quarter.

Most organizations have a reporting button and a security team that would rather see twenty false positives than one silence. Use it.

The shift worth internalizing is this: phishing no longer announces itself through sloppiness. It arrives polished, contextual, and patient. The red flags have moved from the surface of the message to the seams between what's claimed and what's true — the domain that's almost right, the thread you didn't start, the urgency that arrived from nowhere. If you take one habit from all of this, make it the pause. Not a suspicion of everything, just a beat of verification before you act on anything that touches credentials, money, or files. The attackers are counting on speed. You only need to be slower than their deadline.