Phishing remains the most common entry point for cyberattacks on small and medium-sized businesses. One careless second of clicking is enough, and credentials, bank accounts or the whole company IT are compromised. These eight warning signs help you reliably expose phishing e-mails.
1. Check the sender address carefully
The displayed name can be forged at will. Always click on the actual e-mail address: is it really "service@paypal.com" or perhaps "service@paypa1-secure.com"? Even a swapped letter or a foreign domain is a clear alarm sign.
2. Impersonal or strange salutation
"Dear customer" or "Hello user" are suspicious if your bank otherwise addresses you by name. Clumsy translations, wrong umlauts or strange sentence structures are also typical signs of automatically generated phishing e-mails.
3. Pressure and urgency
"Your account will be blocked in 24 hours!" or "Final reminder, act immediately!" are classic manipulation techniques. Reputable providers do not put you under time pressure. Anyone who rushes you wants to switch off your critical thinking.
4. Do not click links blindly
Hover the mouse over every link without clicking. The actual target address is shown at the bottom of the browser. If it does not match the alleged sender, caution is called for. If in doubt, open the website manually in the browser instead of following the link.
5. Treat attachments with caution
Invoices as ZIP files, .exe attachments or Word documents asking you to enable macros are among the most common carriers of malicious code. If in doubt: do not open and ask the alleged sender by phone.
6. Request to enter sensitive data
Banks, authorities and reputable service providers never ask for passwords, PINs or TANs by e-mail. Any mail that asks you to enter such data is very likely phishing.
7. Unusual payment requests
Particularly perfidious is "CEO fraud": an alleged mail from the managing director asks accounting for an urgent transfer. Establish fixed approval processes: every unusual payment is confirmed by phone before it is executed.
8. Take your gut feeling seriously
If something seems strange to you, it usually is. Better to ask the supposed sender once too often than once too little. A short call costs seconds, a successful attack quickly several thousand euros.
What to do if you clicked on a phishing e-mail?
Disconnect the device from the network immediately, change affected passwords from another device and inform your IT support. solutioIT helps you with damage limitation and on request sets up training as well as technical protective measures such as SPF, DKIM and DMARC for your e-mail domain. Why even small businesses are asked by customers about their e-mail security is explained in the article NIS2 for suppliers.