Phishing is fraud in which attackers pose as a trusted organisation or person to obtain passwords, payments or personal data. With AI tools, these emails no longer contain typos and are far more convincing. That makes it more important than ever for employees to know the warning signs.
9 warning signs
- The sender address does not match: The display name looks familiar, but the address comes from another domain (look-alike letters such as "rnicrosoft").
- Urgency and pressure: Phrases like "your account will be closed within 24 hours".
- Unexpected attachments: Files that look like invoices, delivery notes or payment receipts you were not expecting.
- Links go somewhere else: Hovering over the link shows an address different from the text.
- Requests for passwords or codes: Real organisations never ask for passwords or verification codes by email.
- Changed bank details: A supplier announcing a "new bank account" is one of the costliest scams.
- Secret requests from the top: Urgent, confidential payment or gift card requests in the CEO's name.
- Generic greeting: Someone who should know you writes "Dear customer".
- Odd timing and context: Requests outside working hours that do not fit your workflow.
What to do if you are suspicious
- Do not click links, open attachments or reply.
- Verify the request through a channel you already know (such as a phone call), not the one in the email.
- Report the email to IT or your security contact.
- If you clicked by mistake, report it immediately; early reporting limits the damage.
Technical measures are essential too
Awareness alone is not enough. SPF, DKIM and DMARC for your domain, inbound email filtering and multi-factor authentication make an attack much harder to succeed even when someone makes a mistake.
Make training continuous
Short, regular training and realistic phishing simulations work far better than a yearly presentation. The goal is not to blame people but to build the habit of noticing and reporting.
ujans turns your team into part of your security with phishing simulations, awareness training and email security configuration.