Recognising phishing: how to check a suspicious email

4 min read · Updated on 19 October 2026

Phishing is a message that tries to tempt you into doing something you shouldn't: signing in on a fake site, opening an attachment, changing a payment or approving an MFA notification. The messages look more and more genuine, so look at the signs, not the layout.

Seven signs

1. Pressure and threats: "your account will be blocked today", "pay within 24 hours".
2. The sender address doesn't match. The name may say "Microsoft" or a colleague, but the address behind it is from another domain.
3. Links point somewhere else. Hover over the link without clicking and look at the address in the bottom left; on your phone, press and hold the link.
4. You're asked for a password, verification code or payment details. Microsoft and your bank never ask for those by email.
5. Unexpected attachments or QR codes. A QR code in an email is almost always a detour to a fake site.
6. A request to change a bank account number or to pay urgently, even if it seems to come from your director or a regular supplier.
7. An MFA notification on your phone while you aren't signing in. Never approve it.

In doubt?

• Don't click links or open attachments. Go to the website yourself by typing the address.
• For a payment or change request, call the sender on a number you already had, not the one in the email.
• Report the email with the Report button in Outlook, so your administrator can also remove it from colleagues' mailboxes.

Clicked anyway?

It can happen to anyone. Change your password straight away, tell your IT administrator immediately and say what you entered. The sooner it's known, the smaller the damage.