How to Spot a Phishing Email in 30 Seconds: A Checklist for Your Team

Phishing emails are the most common way attackers get into small businesses. They no longer look like obvious scams. Many copy real invoices, shipping notices, and messages from vendors you actually use. The good news: a 30-second habit catches most of them. Share this checklist with everyone on your team.

The 30-second checklist

1. Check the sender's real address (5 seconds)

Tap or hover over the sender's name to see the actual email address. Watch for small changes, like a missing letter, an extra word, or a free email account pretending to be a company.

2. Look for pressure (5 seconds)

"Urgent," "final notice," "account suspended," "pay today." Attackers rush you so you don't stop to think. Pressure is a reason to slow down.

3. Hover before you click (5 seconds)

Before clicking any link, hover over it (or press and hold on a phone) to see where it really goes. If the address doesn't match the company, don't click.

4. Question any request for money or logins (10 seconds)

Be most careful when an email asks you to log in, pay an invoice, buy gift cards, or change bank details. These are the requests attackers want most.

5. Verify another way (5 seconds to decide)

If anything feels off, don't reply to the email. Open the website yourself, or call the person at a number you already have, not one in the email.

One rule for the whole team

Never log in or pay from a link in an email. Go to the site directly or call to confirm. This single rule stops most phishing attacks, even the convincing ones.

What to do if someone already clicked

• Don't panic, and don't hide it. Speed matters more than blame.
• Change the password for that account right away, and anywhere else that password was used.
• Turn on two-factor login if it isn't on already.
• If payment details were shared, call your bank immediately.
• Tell whoever manages your IT so they can check for other damage.

Make it stick

A 15-minute team talk with real examples does more than a long policy nobody reads. Repeat it every few months, and make it easy for staff to ask, "Is this real?" without feeling silly.

Want help? Our Small Business Security Checkup includes phishing training for your team, plus password managers, two-factor logins, and a backup check. Or start with a free 30-minute assessment and get a written list of your biggest security gaps.