At a glance

Recognising phishing is more important than ever. Many fraud attempts look professional, use fluent language and specifically target employees and businesses. The objective is always the same: to get someone to click, enter information or make a payment.

This article explains how to recognise phishing, which scams are common and which practical steps help businesses respond.

What is phishing?

Phishing is an attempt to obtain login credentials, payment details or internal information through fake emails, messages or websites. Common targets include email accounts, cloud services such as Microsoft 365, customer portals, and payment and invoicing processes.

Recognising phishing: 10 warning signs

1) The sender's name looks familiar, but the address does not

The displayed name may be correct while the email address has been slightly altered, for example with transposed letters, extra characters or the wrong domain. Check the actual sender address, not just the display name.

2) Urgency or threats

Messages such as “Act now”, “Your account will be blocked” or “Final reminder” create pressure to stop you thinking before you act.

Phishing emails often lead to fake login pages. Open important websites directly in your browser rather than following links in emails.

4) A request to “quickly confirm” your login

“Your password is expiring”, “Confirm access” or “Approve a document”: when asked to sign in, use your usual route, such as a bookmark or opening the site directly, rather than the link in the email.

5) An unexpected attachment

ZIP files, Office documents and attachments labelled “Invoice” are risky when they arrive without a plausible context. Only open attachments that make sense and that you were expecting.

6) An unusual request from a familiar sender

Be cautious if a “colleague” unexpectedly asks for login credentials, approvals or payments. Messages sent from compromised accounts can look particularly convincing.

7) Details do not add up

The greeting, signature, writing style, project names or departments may seem almost right, but not quite consistent. One detail alone is not always conclusive; the overall picture matters.

8) The URL looks unusual

Check the domain: does it really belong to the organisation? Are there spelling mistakes, extra words or unusual endings? On a login page, the domain matters more than an attractive design.

9) Money is involved: a new IBAN, changed bank details or a new invoice

Invoice fraud and fraudulent payment requests can be particularly costly. Changes to bank details should always follow a defined process, ideally including a callback using a known contact channel.

10) “You're the only person who can do this quickly”

Social engineering exploits helpfulness, stress and hierarchy. When something seems unusual, a brief check by phone or chat is often the quickest way to clarify it.

Recognising phishing emails: everyday examples

Common examples include “Your password is expiring”, “Microsoft 365 security alert”, “Document awaiting approval” and “Your parcel could not be delivered”. What matters is less the particular story than the combination of pressure, a link or attachment, and an unusual request. Practising how to recognise these patterns helps make checking for phishing a routine.

What to do immediately after clicking a phishing link

If you have clicked, a prompt response matters. A clear procedure that people can follow without hesitation is essential.

Where possible, stop clicking, do not enter any information and report the incident internally straight away. If you have entered login credentials, change the password immediately using your usual, trusted sign-in route. Multi-factor authentication and active sessions should also be checked. Within the business, collect suspicious emails centrally, check mailbox rules and forwarding settings, and promptly alert other employees if the scam is circulating.

How businesses can reduce phishing risks over time

Technical filters help, but everyday practices make a major difference: clear approval procedures, a simple reporting channel, short and regular awareness reminders rather than one-off mandatory training, and a culture without blame. This makes recognising phishing a habit rather than an exception.

Verisite helps businesses take a systematic, practical approach to reducing phishing risks, setting up straightforward reporting channels and building employee awareness that works in everyday situations.

A quick checklist: recognising phishing in 15 seconds

Does the sender really match the message? Is someone putting me under pressure? Is the link or attachment unexpected? Am I being asked to sign in or approve a payment? Would checking through a second channel clarify the situation? When something feels wrong, report it rather than clicking.

We can review your current reporting process and typical attack paths with you, then identify specific measures to take immediately.

Further information is available from the German consumer advice centre and the German Federal Office for Information Security (BSI).