Assess a suspicious email

Learning edition: 5 October 2026. Introductory learning material.

No single visual clue can reliably distinguish a genuine email from phishing. Good spelling, a familiar display name and a secure-looking link are not proof of legitimacy.

• Check whether the request fits the context and your normal process.
• Inspect the actual sender and destination, but do not treat those checks as sufficient on their own.
• Open the service through a trusted bookmark or application instead of the message link.
• Confirm unusual information or payment requests with a known contact.
• Use the approved reporting tool; avoid sending confidential message contents to an outside address without authorization.

Activity: Find the reporting instructions in your email service and confirm which internal team receives the report.

Reference: CISA small-business resources. Check the source and your system provider’s current instructions before implementation.

Look closely: Historical example: an account-lock warning creates urgency and asks for immediate verification. Open the service through a trusted route to check independently. Modern AI-assisted phishing may be polished and grammatically correct; spelling mistakes are not a reliable test.

Phishing attempt by Chris Lappas, 2018, via Wikimedia Commons. CC BY-SA 4.0. Unmodified screenshot; displayed for analysis of impersonation.

Practice before the knowledge check

You receive a polished message from “IT Support” asking you to scan a QR code and re-enter your password to prevent account closure. Do not scan or sign in through it. Open your usual support channel independently and ask whether the request is genuine. If you already entered information, report that promptly; do not hide the mistake or try to investigate the sender yourself.

Complete the knowledge check below. Explain your choice before checking the feedback.

Beyond the message: fake verification and repair

QR codes, shared documents and search results can lead to a deceptive page. In a ClickFix lure, a page tells you to run or paste a command to prove you are human or repair a problem. Do not follow that instruction. Close the page and consult your established support channel. Reporting quickly matters if a command was run or information was entered.

Practice: A document preview asks you to open a terminal and paste a “verification” command. Explain why you will stop even if the page displays a familiar logo.

Further reading: Microsoft: Think before you Click(Fix) (21 August 2025).