Recognize a Phishing Email

Overview

Phishing is the most common way attackers get into a work account. The messages look like ordinary email but are designed to trick you into clicking a bad link, entering your password, or paying a fake invoice. This guide shows you how to spot one before you click.

Before You Begin

• You do not need to install anything. You only need to slow down and look closely.
• Know the rule: if a message creates urgency, fear, or excitement, treat it as suspicious until proven otherwise.

Steps

1. Check the sender's full email address, not only the display name. Click or tap the sender to expand it. Look for:
   • Misspelled domains: micros0ft.com, payrol1.com, bostonm1t.com.
   • Mismatched domains: a message claiming to be from your CEO that comes from @gmail.com or a random consulting domain.
2. Look at the greeting. Generic greetings like Dear User or Dear Customer are a warning sign for messages that pretend to know you.
3. Read the message slowly. Phishing often includes:
   • Urgency: "Your account will be closed in 24 hours."
   • Threats: "Failure to act will result in termination."
   • Rewards: "You have won a $500 gift card."
   • Unusual requests: a manager asking you to buy gift cards from your phone.
4. Hover over every link before clicking. On a computer, the real destination appears in the bottom-left of the browser. On a phone, press and hold the link to preview it. If the domain does not match the brand it claims, do not click.
5. Look at attachments with caution. Unexpected invoices, shipping notices, or HTML files are common phishing payloads.
6. Check whether the message asks you to bypass normal process. Real wire transfers, password resets, and W-2 requests follow your company's process. Email shortcuts are a red flag.
7. When in doubt, do not reply or click. Use the steps in Report a Suspicious Email.

Troubleshooting

• If you are not sure whether it is real: contact the sender through a known channel (phone, Teams, in person). Never reply to the suspicious message to verify.
• If you already clicked a link but did not enter a password: close the browser tab and report the message.
• If you entered your password: follow What to Do If Your Account Is Compromised right away.
• If the message looks like internal IT but you are not sure: real BMIT support will never ask for your password.

Related Articles

• Report a Suspicious Email
• What to Do If Your Account Is Compromised
• Spot a Social Engineering Attempt
• Set Up Multi-Factor Authentication with Microsoft Authenticator

Need More Help?

Submit a ticket at support.bostonmit.com or email support@bostonmit.com.