How to read a suspicious message

Start with the sender, not the story

A phishing message works because its story is believable: a parcel, an invoice, a password that is about to expire. A story costs nothing to invent. The sender’s address is harder to fake, so read it first.

Look at the part after the @ and compare it letter by letter with the address you know. A display name such as “IT Service Desk” can be typed by anyone.

Notice what the message wants from you

Almost every phishing message asks for one of three things: your password, a payment, or that you open a file. It also gives you a reason to hurry, because people who hurry skip checks. When an unusual request arrives together with a deadline, treat the deadline as the warning sign.

Check where a link goes

On a computer, hold the pointer over the link and read the address that appears. On a phone, press and hold the link. If the address does not belong to the organisation the message claims to come from, do not open it.

When you need to sign in somewhere, type the address yourself or use a bookmark. A link in a message is never the only way to reach a real service.

Report it, then delete it

The same message has usually gone to many of your colleagues, so reporting protects them too. Use the report button in your mail app or forward the message to your IT team.

If you already clicked or typed a password, say so at once. An early report is the difference between a changed password and a lost account.