Most cyber attacks on small businesses do not start with a hacker breaking through a firewall. They start with an ordinary-looking email and one click. Phishing emails pretend to be from a bank, a delivery company, a colleague or a familiar service, and they are designed to make you act before you think.

As an IT manager, I have seen how convincing these messages can be — and how much damage one click can cause. The good news is that most phishing emails give themselves away if you know what to check. This guide covers the warning signs, what to do when you spot one, and how to protect your team.

What Is Phishing?

Phishing is a scam where an attacker sends a message that looks like it comes from a trusted source, hoping you will click a link, download a file, or hand over a password or payment details. The message might warn that your account will be closed, offer a refund, or share an invoice you were not expecting.

The goal is always the same: get you to act quickly, without checking. Urgency is the attacker's best tool, so anything that pressures you to act immediately deserves a second look.

Seven Warning Signs to Check in Seconds

1. The sender's address is slightly wrong

The display name may say your bank or a known company, but the actual email address tells the truth. Look for small changes: a different domain, extra letters, or a free email service where a company address should be. On a phone, tap the sender's name to reveal the full address before trusting it.

2. The message creates urgency or fear

"Your account will be closed in 24 hours", "unusual activity detected", "payment failed — act now". Legitimate companies do send security alerts, but they rarely demand immediate action by email alone, and they never ask you to confirm a password by replying.

3. The link does not match the text

Before clicking any link, hover over it on a computer — or press and hold on a phone — to see where it really goes. A link that says it goes to your bank but points to an unfamiliar domain is phishing. Shortened links in unexpected emails are also a red flag.

4. Unexpected attachments

An invoice, delivery note or document you were not expecting is a common way to deliver malware. Be especially careful with files that ask you to enable macros or content when you open them — that is a classic attack step.

5. Generic greetings and sloppy writing

"Dear customer" instead of your name, awkward sentences, and spelling mistakes are all warning signs. They are not proof on their own — real companies make mistakes too — but combined with other signs they matter.

6. Requests for sensitive information

No legitimate bank, courier or government office asks for your password, PIN, one-time code or full card details by email. Any message that does is a scam, whatever logo it carries.

7. It does not match what you expected

A delivery notice for a parcel you never ordered, a password reset you never requested, an invoice from a supplier you do not use — if the context does not fit your life, do not engage with it.

What to Do When You Spot a Phishing Email

1. Do not click, reply or download anything. Even replying tells the attacker your address is active.
2. Report it. Use your email app's "Report phishing" option, and if it pretends to be from a company you use, forward it to that company's official abuse or security address.
3. Delete it. Once reported, delete the message so nobody else in the office opens it by mistake.
4. If you already clicked, act fast. Change the password for the account involved from a clean device, turn on two-factor authentication, and check for unfamiliar activity. If payment details were entered, contact your bank immediately. Our guide on setting up two-factor authentication explains that step.

Protecting Your Whole Team

One careful person is not enough — phishing only needs one click from anyone in the office. A few simple habits protect the whole team:

• Make reporting easy and blame-free. People hide mistakes when they fear punishment. The person who reports a click quickly is helping, not failing.
• Run a short training session. Show real examples of phishing emails your team might receive — fake courier messages and invoice scams are common in Bangladesh — and walk through the seven signs above.
• Use two-factor authentication everywhere it is available, especially on email and banking. Even if a password is stolen, the second factor blocks most attacks.
• Keep software updated. Browsers and email apps block many known phishing pages automatically, but only when they are up to date. The basics in our website security guide apply to office computers too.

Frequently Asked Questions

Can a phishing email infect my computer just by opening it?

Simply opening a plain email is very unlikely to cause harm. The danger comes from clicking links and opening attachments. Still, do not open suspicious messages more than necessary — report and delete them.

What if the email comes from someone I know?

Attackers can spoof a familiar name or take over a real account. If a colleague's email contains an unexpected link or an odd request — especially about money — verify it through another channel, such as a phone call, before acting.

Are phishing messages only sent by email?

No. The same tricks appear in SMS, WhatsApp and social media messages — fake delivery updates and prize offers are common. Apply the same checks: verify the sender, do not click blindly, and never share codes or passwords.

What is the difference between phishing and spam?

Spam is unwanted bulk email, usually advertising. Phishing is targeted deception designed to steal information or money. All phishing is harmful; most spam is merely annoying.

Conclusion

Phishing works because it exploits trust and urgency, not technical skill. The defence is a habit, not a product: pause before you click, check the sender and the link, and ask whether the message makes sense. Teach that habit to everyone in your office, back it up with two-factor authentication, and most phishing attempts will fail at the first check. The few seconds a check takes are always cheaper than the damage one click can cause.