What Is a Phishing Email?
A phishing email is a fraudulent message designed to trick you into revealing sensitive information or taking an unsafe action. These emails often pretend to be from legitimate organisations or individuals and may ask you to click a link, open an attachment, make a payment, or provide login details. The goal is typically to steal credentials, install malware, or commit financial fraud.
Best practises for dealing with phishing emails
1. Do Not Interact With the Email
- Do not click any links or buttons.
- Do not open attachments.
- Do not reply to the sender.
- Do not scan QR codes contained in the email.
Even previewing attachments can be risky in some environments.
2. Check for Common Phishing Indicators
Be alert for the following warning signs:
- Urgent, threatening, or pressure-based language.
- Requests for passwords, MFA codes, payment details, or personal information.
- Spelling mistakes, poor grammar, or unusual formatting.
- Sender addresses that do not match the organisation being impersonated.
- Links that lead to unexpected or suspicious websites when hovered over.
3. Verify the Message Independently
- Contact the organisation using official contact details from their website, not those provided in the email.
- If the email claims to be from a colleague, verify through a separate communication channel.
4. Report the Email
- Use your email client’s Report Phishing or Report Junk feature, if available.
- Or forward the message to your organisation’s IT or security team.
- Avoid forwarding the email to others unless instructed.
5. Delete the Email
- Delete the message after reporting it.
- Empty it from the Deleted Items or Trash folder if required by policy.
6. If You Interacted With the Email
If you clicked a link, opened an attachment, or entered information:
- Disconnect from the network immediately.
- Change your password(s) from a secure device.
- Report the incident to IT or security without delay.
- Monitor your accounts for unusual activity.
7. Ongoing Best Practices
- Keep your device and software up to date.
- Use strong, unique passwords and enable multi-factor authentication.
- Treat unexpected emails about payments, invoices, or account changes with extra caution.