What is a Phishing Email?

A phishing email is a fake message that pretends to come from a trusted company or person, such as your bank, a courier, Microsoft, or your boss, to trick you into clicking a link, opening an attachment, or sharing passwords or payment details. It is one of the most common ways cyberattacks start. 

Warning signs of a phishing email 

• The sender address does not match the company name, or has small misspellings 
• Urgent language: “your account will be locked”, “pay now” 
• Links that show a different address when you hover over them 
• Unexpected attachments, especially ZIP files or documents asking you to enable macros 
• Requests for passwords, OTPs, or payment details 

Common examples 

• A “password expired” email that leads to a fake Microsoft 365 login page 
• A fake invoice or payment request from a known supplier 
• A courier email asking you to pay a fee to release a parcel 

What to do 

Do not click links or open attachments. Report the email to your IT team, then delete it. If you already clicked, change your password from another device and tell IT immediately. For phishing by text and phone, see our full guide to phishing, smishing, and vishing.

Frequently Asked Questions

What is a phishing email? 

A fake email that pretends to be from a trusted source to trick you into clicking a link, opening an attachment, or giving away passwords or payment details. 

How can I tell if an email is phishing? 

Check the sender address, hover over links before clicking, and be suspicious of urgent requests for passwords, OTPs, or payments. 

What should I do if I clicked a phishing link? 

Change your password from another device, turn on multi-factor authentication, and tell your IT team right away.

Want fewer phishing emails reaching your team? 

CloudConsole sets up email filtering, multi-factor authentication, and staff training through our cybersecurity services. Get a free quote.