How to Spot a Phishing Email: Warning Signs and What to Do

A phishing email tries to trick an employee into handing over a password, money, or confidential data by pretending to come from a colleague, a bank, a supplier, or an email provider. This article helps employees recognize these messages and helps administrators respond properly and reduce the risk for the whole company.

What attackers want

Almost every phishing email has one of a few goals:

• Steal a password. A "your mailbox is full" or "verify your account" message leads to a fake sign-in page made to look like your webmail.
• Get money. The "CEO" asks for an invoice to be paid urgently, or a "supplier" announces new bank details.
• Infect a computer. The attachment is an archive, a document with macros, or a file with a double extension like reconciliation.pdf.exe.
• Collect data. A request for a staff list, passport copies, or an export from your accounting system.

Spam and virus filters stop a large share of these messages, but not all of them. A carefully crafted email with no attachment and a "clean" link can get past any filter, so the last line of defense is an attentive employee.

Signs of a phishing email

One sign alone may not mean much, but two or three together are a good reason to stop and think.

Sign	Example
Urgency and pressure	"Pay by 3:00 PM or the contract will be canceled," "your mailbox will be locked in 24 hours"
Unusual channel or request	The director writes from a personal address and asks you to buy gift cards or keep a payment secret
Address doesn't match the name	The display name says "Accounting," but the address is acc.office2024@gmail.com
Lookalike domain	examp1e.uz instead of example.uz, example-uz.com, example.uz.secure-login.net
Link goes somewhere else	The link text shows your webmail address, but hovering over it reveals a completely different domain
Suspicious attachment	A password-protected archive with the password in the email body, .exe, .js, .scr, or .iso files, documents asking you to "enable content"
Generic greeting	"Dear user" instead of your name, even though the sender supposedly knows you

How sender spoofing works

The "From" field is just text, and technically anyone can put anything in it. Attackers use several tricks:

1. Display name spoofing. The address belongs to someone else, but the name matches your manager's. Phone email apps often show only the name, so the trick is easy to miss.
2. Lookalike domain. The attacker registers a domain that differs by one character or uses a different extension. Such a message can even pass SPF and DKIM checks, but for the attacker's domain, not yours.
3. Direct spoofing of your domain. The sender puts an address on your domain in the From field. This is exactly what SPF, DKIM, and DMARC protect against: when they are set up correctly and the DMARC policy is quarantine or reject, receiving servers will send these messages to spam or refuse them.
4. A real mailbox that has been compromised. This is the most dangerous case. The email comes from a real partner, inside a real conversation, but an attacker already controls the partner's mailbox. Technical checks can't help here; only verifying the request through another channel can.

What employees should do

If a message looks suspicious, follow these simple steps:

1. Don't click links or open attachments. Don't reply either: a reply confirms that your address is active.
2. Verify the request another way. Call your colleague or partner at a number you already know, not one from the email. This matters most for any request involving payments or changes to bank details.
3. Tell your administrator or IT contact. Forward the message as an attachment so the headers needed for analysis are preserved.
4. If you already entered your password on a suspicious page, change your mailbox password right away from a different device you trust, and tell your administrator. See our article on mailbox security for details.
5. If you opened an attachment, disconnect the computer from the network and tell your administrator. Don't try to clean it up yourself.

What administrators should do

The administrator's job is to reduce the number of phishing emails that reach employees and to limit the damage if someone makes a mistake.

During an incident

• Save the full message source with headers. They show the sending server and the authentication results.
• Find out who else received the same message and warn them.
• If a password was entered on a fake page, change it, end active sessions, and check the mailbox settings: forwarding rules, filters, and the auto-reply. Attackers often add a hidden forward to an outside address.
• If the message came from your own domain, check whether it was actually sent from one of your mailboxes.

Prevention

• Turn on two-factor authentication. Even if a password is stolen, nobody can sign in without the second factor. WebAuthn/FIDO2 hardware keys also simply don't work on fake sites.
• Set up SPF, DKIM, and DMARC for your domain and move gradually to a strict DMARC policy.
• Review the spam quarantine regularly. It can hold phishing messages from lookalike domains as well as legitimate mail.
• Agree on an internal rule: any change of bank details and any urgent payment must be confirmed by voice.
• Run short training sessions for employees and show them real examples of messages your company has received.

How your email service helps

In MCMail, incoming mail is checked by the Rspamd spam filter and the ClamAV antivirus, suspicious messages go to the spam quarantine, and we set up SPF, DKIM, and DMARC for your domain. Two-factor authentication, including WebAuthn/FIDO2 keys, and password brute-force blocking are also available. This noticeably lowers the risk, but it doesn't replace vigilance: no filter offers complete protection against messages written specifically for your company.

If you've received a message that looks suspicious and you're not sure what to do, contact support at @mycloudsupport and we'll help you read the headers.