Recognizing phishing: 7 signs in an email that doesn't add up

You get an email saying your parcel could not be delivered. Or an invoice from a supplier, and you think: this amount can't be right. Or your bank says your account will be blocked unless you log in within an hour. Three times the same trick, three different disguises.

Recognizing phishing is mostly a matter of knowing what to look at. Scammers are not always clever, but they count on one thing: that you are busy and click too fast. Below are seven signs you can check in a few seconds, with examples from banks, parcel services and suppliers. At the end you can read what to do if you have already clicked.

Recognizing phishing: the 7 signs

One sign is rarely enough to be sure an email is fake. Two or three together are a good reason to stop. And sometimes everything looks right and only the request itself is strange. Even then: stop.

1. The sender address is wrong

Don't look at the name shown at the top. Look at the actual email address behind it. Anyone can enter a name like “PostNL”. The address is harder to fake, so scammers often use a domain that looks very similar.

• info@postnl-bezorging.info instead of an address on the real PostNL domain
• service@rnijnbank.nl, where “rn” looks like an “m” at first glance
• A random Gmail or Outlook address on an email that is supposed to come from a company

On a phone, you often only see the address when you tap the sender name. Do that, every time.

2. There is urgency or a threat

“Your account will be blocked within 24 hours.” “Final notice.” “Your parcel will be sent back.” Urgency is a phisher's main weapon, because people in a hurry don't think. A real bank, tax authority or supplier rarely has a reason to make you act within an hour via a link in an email.

3. The greeting or the context doesn't fit

“Dear customer” or “Dear user” while the company knows your name. That is a warning, but not proof: good fake emails do use your name, sometimes from a leaked address list. So look at the context too. Are you expecting this parcel? Do you have an account with this bank? Is this the address you normally use to contact that supplier?

4. The link goes somewhere else

Hover your mouse over the link without clicking. The real address then appears at the bottom of your screen. On a phone, press and hold the link. If you see a strange string of letters, a shortened link or a domain that has nothing to do with the sender, that is enough.

Also pay attention to the order in an address. In login.mijnbank.nl.beveiligd-portaal.com is the real domain beveiligd-portaal.com. The part directly before the last extension decides who owns the site. Everything before it is decoration.

5. The attachment is unexpected or has an odd file type

An invoice usually comes as a PDF. Attachments such as zip, html, iso or a file with two extensions like factuur.pdf.exe do not belong there. A PDF can also just be an image with one big button that leads to a fake site. Do not open anything from a sender you did not expect, not even “just to take a quick look”.

6. You are asked for details or a payment

A bank will not ask you to give your PIN, password or login code by email or phone. A parcel service will not ask for card details for a few euros of “redelivery costs”. Those small amounts are exactly the point: it is not about the euros, but about your card details and the confirmation in your banking app.

A request to do something differently than usual is also suspicious. A “new account number” from a supplier is the best-known example. We will come back to that shortly.

7. Small mistakes in language, design or logic

Odd sentence structure, a logo that is a bit blurry, a signature without real contact details, a date that does not add up. Note: this signal is becoming less and less reliable. Scammers' texts are often flawless these days. A neat email is therefore no proof that it is real. Use this signal as an extra check, not as the only one.

Fake invoice from a supplier: this is where it often goes wrong

With personal email, it is about a few euros or a login code. With business email, it is about real amounts. The classic is the email from an existing supplier, sometimes with a realistic-looking invoice, saying that the account number has changed. The company exists, the invoice looks like the previous one, only the IBAN is different.

What helps:

1. Call the supplier on the phone number you already had, not the number from the email.
2. If an account number has changed, always ask for confirmation, even if the email seems to come from a known address. A hacked mailbox of the supplier looks exactly the same from the outside.
3. Compare the invoice amount and the invoice number with earlier invoices and with your order.
4. Agree within your team that changes to account numbers are never processed by email alone.

Do you make invoices yourself? Then it helps to give customers one fixed, recognisable way of invoicing. With your own free invoicing software, your customers always see the same layout and sender, and a deviating fake invoice stands out sooner.

What do you do if you already clicked?

First, stay calm. Just clicking a link is often less serious than people think. What you do now depends on what happened next.

You only clicked the link

Close the tab. Do not enter anything. Check whether anything was downloaded and delete it without opening it. Run a virus scanner to be sure. In most cases, nothing is wrong.

You entered your details

1. Go to the real website by typing the address yourself or opening the official app, and change your password right away.
2. Also change the password everywhere you used the same one. It is not a fun job, but it is the one that prevents the most damage.
3. Turn on two-step verification if it was not already on.
4. For an email account, check the settings for forwarding rules and rules that delete emails automatically. Attackers often set these up to read along unnoticed.

You entered bank or card details, or transferred money

Call your bank right away, using the number on your bank card or in the official app. Every minute counts. The sooner a payment is reported, the better the chance that it can still be stopped. Block your card and file a police report. Keep the email and screenshots, because you will need them.

You opened an attachment

Disconnect the device from the network and wifi, and do not switch it off until you have spoken to someone who knows what to do. If it is a work computer, report it right away to whoever handles your IT. Waiting out of embarrassment only makes it more expensive. If it is a business incident that you cannot assess yourself, a cybersecurity partner can help you find out what happened.

How to make phishing harder for yourself and your team

You do not have to treat every email like a criminal investigation. A few fixed habits do a lot:

• Never use a link in an email to log in. Type the address yourself or use the app.
• Use a password manager. It only fills in your details on the correct domain, so on a fake site the field stays empty. That is already a signal.
• Choose passwordless login where possible. A passkey only works on the real website, so a fake site cannot do anything with it.
• Make sure your own domain cannot be used to send email in your name. With SPF, DKIM and DMARC you reject unauthorized email. You can read how in Setting up DMARC for Microsoft 365 and Google.
• Discuss with your team how you handle suspicious email. Who reports it, to whom, and is it fine to simply ask “is this right?”

Want to know whether your own domain is set up correctly? The free website check looks at SPF and DMARC, among other things.

What to do now

Take the last email you had doubts about and go through the seven signals: sender address, urgency, context, link, attachment, the request itself and the details. You will soon notice that you can do it in ten seconds. Still unsure? Call the sender on a number you know yourself, or go to the site by typing the address yourself.

If your team gets invoices and parcel notifications every day, practising with fake emails is the fastest way to learn. Netslim runs phishing simulations that show you who clicks, without any harm done.

Frequently asked questions

How do I recognise a fake email from my bank?

Look at the real sender address and at what is being asked of you. A bank does not want you to share your PIN or login code, and it does not force you to act through an email. If you are unsure, open the bank app itself and check whether the same message appears there.

Can I get infected just by opening a phishing email?

Usually not. The risk is in the link, the attachment or the details you enter. Modern email programs also do not load everything automatically. Still, it is wise to delete the email afterwards and not click anything.

What is the difference between phishing and spam?

Spam is unwanted advertising, often annoying but usually not dangerous. Phishing wants something from you: your password, your bank details or a payment. That is why phishing pretends to be a known sender, such as your bank or a supplier.

What do I do with a phishing email I received?

Do not click anything and do not reply to the email. Warn your colleagues if it is a business email, and then delete it. If it still ends up in your inbox when your email provider should have blocked it, mark it as phishing or spam so the filter learns from it.

How can I tell if a link is safe without clicking it?

Hover your mouse over the link, or press and hold it on your phone, and read the address that appears. The part directly before the last extension, such as .nl or .com, shows who owns the site. If that does not match the sender, do not click.