5 Signs a Phishing Email Is Targeting Your Business

Phishing has evolved far beyond the Nigerian prince emails of the early 2000s. Today's attacks are sophisticated, personalised, and often indistinguishable from legitimate business communications at first glance. For Derbyshire businesses, the stakes are high: a single clicked link can lead to ransomware deployment, wire fraud, or a devastating data breach.

The good news? Phishing emails still leave telltale signs. Train your staff to recognise these five red flags, and you'll stop the majority of attacks before they succeed.

Sign 1: Urgency and Threats

Phishing emails thrive on panic. They create artificial time pressure to bypass your critical thinking:

• "Your account will be suspended in 24 hours"
• "Urgent: Payment required immediately to avoid legal action"
• "Your password has been compromised — reset now"
• "Unusual activity detected — verify your identity"

Legitimate organisations rarely demand immediate action via email. When you see urgency, pause. Contact the company directly through a known phone number or website — never through the contact details in the suspicious email.

Sign 2: Suspicious Sender Addresses

The display name might say "HMRC" or "PayPal," but the actual email address tells the real story. Hover over the sender name (don't click) to reveal the full address. Watch for:

• Extra characters: hmrc@gov-uk-verify.com instead of hmrc.gov.uk
• Misspellings: paypa1.com, amaz0n.co.uk
• Generic domains: gmail.com, outlook.com for supposedly official communications
• Subdomains that look official: secure-paypal-login.com (not paypal.com)

Sign 3: Unexpected Attachments or Links

Even if an email appears to come from a known contact, unexpected attachments should trigger caution. Modern phishing often uses:

• invoices with embedded macros
• Fake PDFs that are actually executable files (.pdf.exe)
• Links that redirect through multiple URLs before landing on a fake login page
• QR codes that bypass email security scanners

Hover over links to see the actual destination URL before clicking. If it doesn't match what you'd expect, don't click it.

Sign 4: Requests for Sensitive Information

No reputable organisation will ask for passwords, PINs, or payment card details via email. Ever. If an email asks for:

• Your password or login credentials
• Bank account or payment card details
• Two-factor authentication codes
• Personal information "for verification"

It's a phishing attempt. Delete it immediately.

Sign 5: Subtle Language and Formatting Errors

AI-generated phishing is reducing spelling mistakes, but many attacks still contain subtle clues:

• Generic greetings ("Dear Customer" instead of your actual name)
• Awkward phrasing that sounds translated
• Formatting inconsistencies (mismatched fonts, colours, or logos)
• British English mixed with American spellings ("organization" instead of "organisation")

Technical Controls That Block Phishing Automatically

User awareness is crucial, but it shouldn't be your only defence. We implement technical controls that stop phishing before it reaches inboxes:

• DMARC, DKIM, and SPF email authentication to prevent domain spoofing
• Advanced email filtering with sandboxing for attachments
• Link rewriting and click-time protection that blocks malicious URLs even after delivery
• Browser isolation that renders suspicious links in a secure sandbox
• Multi-factor authentication so stolen passwords alone can't compromise accounts

"Since implementing Liberty ICT's email security stack, our phishing click rate dropped from 12% to under 1%. The combination of technical controls and staff training has been transformative." — Education Client, Derbyshire