How to spot a phishing email

Phishing emails pretend to come from someone you trust so you'll click a link, open an attachment or type your password into a fake page. They are the most common way attackers break into Microsoft 365 accounts, so learning the signs is one of the best things you can do.

Check the sender

• Look at the actual email address, not just the display name. "Microsoft 365 Team" can be sent from any address.
• Watch for look-alike domains, such as micros0ft-support.com or your own company name with an extra letter.
• Be extra careful with Outlook banners like "You don't often get email from…" or "External" on a message that claims to be from a coworker.
• A real contact can be hacked. If an unexpected message from someone you know feels unusual, confirm with them by phone or in person.

Hover before you click

On a computer, rest your mouse pointer over a link or button (without clicking) to see where it really goes. On a phone, press and hold the link to preview it. If the address doesn't match the company it claims to be, or is a jumble of letters, don't open it.

Watch for pressure and urgency

Phishing tries to make you act before you think. Common phrases include "your account will be closed today", "payment overdue", "unusual sign-in detected" or "the CEO needs this right away". Real organizations rarely threaten you with a deadline of minutes.

Common lures in business email

• Invoices and payments: an unexpected invoice, a "past due" notice, or a request to change a vendor's bank details. Always verify payment changes by calling a known phone number, never one from the email.
• DocuSign, Adobe Sign or shared files: "You have a document to review" that leads to a sign-in page. Ask yourself whether you were expecting it.
• Voicemail and fax notices: "You have a new voicemail" with an attachment or a link that asks for your password.
• Password expiration or mailbox full: messages that ask you to "keep your current password" or "upgrade your storage".
• Gift card requests: a "manager" asking you to buy gift cards and send the codes is always a scam.

Be careful with QR codes

Some phishing emails include a QR code instead of a link, asking you to scan it with your phone to "re-verify" your account or view a document. This moves you to a device with fewer protections. Don't scan QR codes from unexpected emails, and never enter your work password on a page you reached that way.

Red flags inside the page

If you do land on a sign-in page, check the address bar. Microsoft 365 sign-in uses addresses such as login.microsoftonline.com. If it's anything else, close the page. Also be wary of any request for a multi-factor code or approval you didn't start.

How to report a suspicious email

1. Don't click links, open attachments or reply.
2. In Outlook, select the message and click Report on the toolbar, then choose Report phishing. (In some versions this button is called Report Message.)
3. If your organization has asked you to, also let us know by opening a ticket so we can check whether others received it.

Published on - 01-01-1970 05:30am