A quick, practical guide every staff member can use — because so many breaches start with a single click.
Phishing is one of the most common ways cyber attacks on Australian businesses begin: an email designed to trick someone into clicking a link, entering a password or paying a fake invoice. The good news is that with a little awareness, most phishing is catchable. Here is what to look for.
How do you spot a phishing email?
To spot a phishing email, pause before you act and check five things: is it urgent, is it unexpected, does the real sender address match the name, does the link go where it claims, and is it asking for a password or a payment change? Key IT, Melbourne's security-first IT partner, recommends every staff member run these checks before clicking anything, because most phishing still gives itself away with at least one of the signs below.
A sense of urgency
"Your account will be closed in 24 hours." Pressure is designed to make you act before you think.
An unexpected request
A login prompt, a payment, or a document you were not expecting.
A mismatched sender
The display name looks right but the actual email address is subtly wrong — a lookalike domain or a public address.
Links that do not match
Hover over a link (without clicking) and check whether the real destination matches what it claims.
Requests for credentials or payment changes
Especially a "supplier" advising their bank details have changed.
What do real phishing emails look like?
These phishing email examples are worth showing every new starter:
The fake Microsoft 365 sign-in
"Your password expires today" or "A document has been shared with you", linking to a copycat login page. The tell: an unexpected sign-in on a web address that isn't Microsoft's.
The changed bank details
A supplier asks you to update their account before the next invoice, often from their real but compromised mailbox. The tell: any change to payment details.
The boss in a hurry
"I'm in a meeting, can you buy gift cards or send a transfer for me?" The tell: urgency plus a reason you can't check.
The parcel, toll or tax notice
A missed delivery, unpaid toll or refund to "confirm". The tell: a link asking for logins or card numbers.
The QR code
"Scan to re-verify your MFA." The tell: it moves you to your phone, away from email filtering.
Why is phishing harder to spot now?
Phishing is harder to spot now because the old advice about typos and bad grammar is increasingly outdated. AI now writes flawless, convincing phishing emails, and attackers often send from genuinely compromised accounts of people you know. So treat unexpected requests involving money, passwords or sensitive data as suspicious even when the email looks perfect — verify through a separate channel. We explain the shift in more depth in why the old phishing advice no longer works.
What is the golden rule for a suspicious email?
If an email asks you to do something involving money, credentials or sensitive information, and anything about it is unexpected — stop and verify using a known phone number, not the contact details in the email. Thirty seconds of verification beats a breach. The same goes for phone calls: AI can now clone a familiar voice, so hang up and ring back on a number you know is genuine.
What should you do if you think you clicked?
Do not panic, and do not hide it — speed matters more than embarrassment. Disconnect the device from the network if you can, change your password from a different device, enable multi-factor authentication if it is not already on, and report it to your IT team immediately. A fast report often means the difference between a non-event and an incident. If you are a Key IT client, that means our helpdesk — and your systems are also covered by 24/7 SOC monitoring.
If you typed a password into a fake page, treat it as stolen and change it everywhere you have reused it. For a work Microsoft 365 account, a new password alone isn't enough: it doesn't end sessions the attacker already holds or remove forwarding and inbox rules they added. Our first-hour checklist for a hacked Microsoft 365 account walks your IT admin through each step. A free dark web scan shows which of your work email addresses have already turned up in data breaches.
Why does training your team pay off?
Your staff are both your biggest risk and your strongest defence — the difference is awareness. Regular, low-key training and simulated phishing measurably lift how often people spot and report attacks. See how it works on our phishing simulation page.
Frequently asked questions
What are the signs of a phishing email?
Urgency, unexpected requests, mismatched sender addresses, links that do not match their text, and requests for passwords or payment changes.
What are some examples of phishing emails?
A fake Microsoft 365 password-expiry email, a supplier whose bank details have "changed", an urgent gift card request from "the boss", and parcel, toll or tax notices. Each pushes you to click, log in or pay.
Can phishing emails look completely legitimate?
Yes. AI now writes flawless phishing, and attackers use compromised real accounts. Verify unexpected money or credential requests through a separate channel regardless of how the email looks.
What should I do if I clicked a phishing link?
Disconnect the device, change your password from another device, enable MFA, and report it to IT immediately. If you entered your Microsoft 365 password, IT should also sign the account out of every session and check for new forwarding or inbox rules. Speed limits the damage.
Is it dangerous to just open a phishing email?
Usually not on its own. The risk comes from clicking links, opening attachments, scanning QR codes, entering a password or replying. If you only opened it, report and delete it. If you did more, tell IT straight away.
How do I report a phishing email?
At work, tell your IT team (or use Outlook's Report button if it is switched on), then delete it without replying or clicking. Australian businesses can also report cybercrime through ReportCyber at cyber.gov.au, and scams to Scamwatch.
How do I protect my business from phishing?
Multi-factor authentication, email filtering, staff training and monitoring together dramatically reduce the risk.
Would your team spot the next one? A free phishing simulation demo shows, safely, how many of your team would click.
Request the Free Demo