How to spot a phishing email.

A phishing email pretends to come from someone you trust, so that you will click a link, open a file, type in a password or pay an invoice. Most are sent by the million and are easy to spot. The dangerous ones are written for your business, use real names and arrive at a believable moment.

Six checks

1. Look at the full address. The display name can say anything. Tap or hover to see the address behind it, and read the part after the @ sign letter by letter.
2. Ask what it wants you to do. Sign in, pay, open an attachment or buy gift cards. A request that leads to money or a password deserves a second look.
3. Notice the pressure. “Today”, “urgent” and “keep this between us” are there to stop you checking.
4. Check where the link goes. Hover over it, or press and hold on a phone. If the address is not the organisation’s real website, do not follow it.
5. Be wary of unexpected attachments, especially invoices, voicemails and shared documents you were not waiting for.
6. Question any change of bank details. This scam is called business email compromise. It often arrives from a supplier’s real account after that account has been broken into.

When you are not sure

Check through a different channel. Call the person on a number you already have, or type the organisation’s address into the browser yourself. Do not use the phone number or the link in the message, because they belong to whoever sent it.

If you have already clicked

1. Tell whoever looks after your IT straight away. Minutes matter, and nobody should be in trouble for reporting.
2. If you typed in a password, change it on the real website, and anywhere else you use the same one.
3. If money was sent, call your bank immediately and ask them to stop or recall the payment.
4. Keep the email. It helps to work out who else received it.
5. Report it. In Australia, cybercrime can be reported to the Australian Signals Directorate through ReportCyber.