For years the easiest way to spot a phishing email was the writing: odd spelling, clumsy grammar, a greeting that didn't quite fit. AI tools have fixed all of that for attackers. Phishing emails now read like they were written by a careful colleague.
The good news is that the checks that actually work never depended on spelling.
Stop and check the sender
Look at the full email address, not just the display name. A name you trust can sit in front of an address you don't. Watch for lookalike domains with a swapped letter or an extra word.
Be suspicious of urgency
Phishing works by rushing you. "Your account will be closed today." "The CEO needs this paid before lunch." "Your parcel is waiting." Pressure to act now is the clearest warning sign there is. AI makes it more convincing, not less.
Check requests through another channel
If an email asks you to pay an invoice, change bank details, buy gift cards or share a login, check it by phone using a number you already have. Not the number in the email. This one habit stops most invoice and payment fraud.
Hover before you click
On a computer, hover over a link to see where it really goes. On a phone, press and hold. If the address doesn't match the company it claims to be from, don't open it.
Treat unexpected attachments with care
An attachment you weren't expecting deserves a second look, even from someone you know. Their account may have been taken over.
Login pages are the real target
Many phishing emails lead to a fake Microsoft 365 sign-in page. If you've clicked a link and you're asked to sign in, close it. Go to the site directly instead. Multi-factor authentication is your safety net if a password does get stolen.
If you think you've clicked something
Tell your IT team straight away. A quick password reset and a check of the account is far easier than cleaning up a week later. Nobody should be embarrassed to report it.
Regular security awareness training and simulated phishing keep these habits fresh for the whole team.