A phishing email does not have to be badly written. It can use a convincing logo, a real person's name, a copied invoice, or an existing conversation. A compromised supplier account can even send a fraudulent request from the address you normally trust.
The useful question is not only whether an email looks professional. Ask what it wants you to do and whether that action makes sense. A request to change payment details, enter a password, open an unexpected document, or approve a sign-in deserves a pause and an independent check.
1. Start with the request, not the appearance
Look for urgency, pressure, secrecy, an unusual payment instruction, or a demand to sign in again. These are reasons to verify the request, not proof that every urgent message is malicious.
Compare it with the normal workflow. Does a supplier usually send account changes this way? Would your manager ask for gift cards by email? Should a document require your business password on an unfamiliar page? A request that changes the process is often more revealing than its spelling.
2. Review the sender and reply address
Expand the sender details and read the complete address. Check for lookalike domains, extra words, different endings, or a reply address that does not match the organization. A display name alone is easy to imitate.
A correct-looking address is still not a guarantee. Accounts can be compromised, and an attacker can reuse a legitimate conversation. Treat sender inspection as one part of verification, especially when money or account access is involved.
3. Inspect the destination without visiting it
On a desktop, hovering can reveal where a link goes. On a phone, a long press may show a preview, but avoid an action that opens the destination. Read the hostname rather than only the reassuring words in the path.
For example, a trusted company name before a different final domain does not make the site belong to that company. HTTPS encrypts the connection but does not prove the business behind the page is legitimate. If the link says you need to check Microsoft 365, open your normal bookmark or type the known service address yourself.
4. Use a separate, trusted way to confirm
For an invoice or bank-detail change, call a number already on record or obtained from a trusted source. Do not use the new phone number inside the suspicious message. Replying in the same thread may send your question straight back to the attacker.
A simple payment-verification process helps busy staff know what to do. Identify who can approve a change, which contact should be called, and how the check is recorded. The procedure should work even when the email looks completely normal.
5. Report the message and act on what actually happened
Use the reporting method agreed by your organization. Keep the original message available for the IT team rather than forwarding it casually to coworkers. Follow their instructions about deletion or evidence retention.
If you entered a password, approved a sign-in, installed software, or sent money, say so promptly. A quick report is more valuable than waiting to see whether anything breaks. Contact the bank immediately if a payment may have been misdirected, and use a separate channel to reach IT if the mailbox itself may be compromised.
Make the checklist part of everyday work
Technology controls and staff habits should reinforce each other. Email protection, MFA, access reviews, awareness training, and a clear incident-reporting path address different parts of the same problem.
Level UP IT helps Louisville business teams review these controls and the practical workflows around them. Start with the messages and decisions your staff actually face, not only an annual training slide deck.
Official references
Product menus and account policies can change. These publisher guides provide additional detail.
Need help with business IT?
Level UP IT supports Louisville and Kentucky businesses with practical troubleshooting, cybersecurity, cloud tools, and recovery planning.
Explore relevant IT support →Talk with our team →