Phishing emails impersonate a trusted sender, usually a bank, boss, or software provider like Microsoft, to trick you into clicking a link, opening an attachment, or handing over login details. If a message pushes urgency and asks for credentials, money, or personal data, CISA’s guidance is blunt: don’t click, verify through a number or app you already trust, then report it. These phishing patterns appear daily across Australian small businesses, and they rarely change much.
TL;DR:
- Most phishing emails leverage familiar brands or organizations but host malicious links on wrong or suspicious domains, which can be identified through domain inspection.
- Urgency, authority, and fear are the psychological levers that increase the success rate of phishing attacks, especially in business email compromise schemes.
- Simple checks like hovering over links, verifying sender addresses, and avoiding shortened URLs can prevent most spam and spoofing attempts.
- Modern phishing tactics include MFA prompt flooding, browser-in-the-browser fake login pop-ups, and malicious code assembled inside your browser to evade filters.
- Speedy response steps, such as changing passwords immediately and reporting suspicious emails, greatly limit damage without needing technical expertise.
Table of Contents
- Common phishing email examples and what gives them away
- Red flags and quick checks anyone can do
- Newer phishing formats that slip past old habits
- What to do if you clicked or received a phishing email
- Why experience with real incidents changes how you see the risk
- Individuals versus businesses: why workplace scams look different
- How phishing campaigns actually get delivered
- The psychology behind why phishing works
- Spotting spoofed addresses and lookalike domains
- Using your email client’s own tools to catch phishing
- Handling attachments and links without getting caught
- What years of cleaning up after phishing attacks teaches you
- How Techbug helps businesses stop phishing before it costs them
- Where to check the facts yourself
- Sources
Common phishing email examples and what gives them away
Most phishing emails fall into a handful of templates. Once you’ve seen each one annotated, they get much easier to spot in your own inbox.
Credential harvesting (fake Microsoft or Google login)
Subject line: “Your password expires today. Verify now to keep access.” The email mimics a Microsoft 365 or Google Workspace login screen almost pixel-for-pixel. Attackers favour these two brands specifically because one set of stolen credentials often unlocks email, file storage, and dozens of connected apps in one go, according to analysis from a SOC analyst. The red flag: the “verify” button leads to a login page hosted on a domain that isn’t microsoft.com or google.com, just something that looks close at a glance (“micros0ft-secure.com”).
Fake invoice or changed banking details
Subject: “Updated payment details for Invoice #4471.” This one targets accounts teams. It arrives looking like a legitimate supplier email, sometimes even hijacking a real email thread, and asks staff to update the bank account for an upcoming payment. The red flag: any request to change banking details by email alone, with no phone confirmation, should stop the payment cold. This exact tactic also shows up in payroll-targeted fraud, where scammers impersonate an employee to redirect a salary payment instead of a supplier invoice.
Shipping notices and subscription renewals
Subject: “Delivery failed, action required” or “Your Netflix subscription payment failed.” These lures rely on volume rather than precision, and they’re timed around parcel delivery periods or common renewal dates. The red flag: a tracking link that redirects through two or three unrelated domains before landing anywhere near the courier’s actual site.
CEO fraud and business email compromise (BEC)
Subject: usually blank, or a continuation of a real internal thread like “Re: Re: Quick favour.” The message appears to come from a director or manager, often timed for when that person is travelling and hard to reach by phone. It asks for a wire transfer, gift cards, or sensitive files, and leans hard on authority and urgency rather than any technical trick. The red flag: the tone doesn’t match how that person usually writes, and the request bypasses your normal approval process entirely.
Shared document and DocuSign lures
Subject: “A document has been shared with you” or “Please review and sign.” The email contains a link or attachment styled to look like SharePoint, Google Drive, or DocuSign. The red flag: the attachment is a macro-enabled Word or Excel file (.docm, .xlsm), which is the same delivery method behind large-scale malware campaigns like Emotet, where a single opened attachment led to widespread follow-on fraud and further infections.
QR code quishing and MFA prompt bombing
A PDF attachment contains nothing but a QR code and a line like “Scan to reset your account.” There’s no clickable link for your email filter to scan, which is exactly the point. Separately, some attacks skip email content altogether and just flood your phone with multi-factor authentication prompts until you approve one out of sheer irritation. Neither of these fits the “check for bad grammar” advice most people grew up with.
- Credential harvesters mimic Microsoft/Google login pages almost exactly
- Fake invoices target finance staff with urgent banking changes
- Shipping and subscription lures rely on volume, not precision
- CEO fraud exploits authority and timing, not technical tricks
- Shared-doc lures often carry macro-enabled attachments
- Quishing hides the malicious link inside a QR code image
Pro Tip: Screenshot any suspicious email before deleting it. If you need to report it later, you’ll want the full headers intact, not just your memory of what it said.
Red flags and quick checks anyone can do
You don’t need to be an IT specialist to catch most phishing attempts. A short, repeatable sequence of checks catches the majority of them before any damage is done.
- Compare the display name to the actual address. “Ali from Accounts” might display nicely, but the real address underneath could be a string of random characters at a free webmail domain. Click or tap the sender’s name to reveal it.
- Check the Reply-To field separately from the From field. Some phishing emails spoof the From address but quietly route replies to a completely different address the attacker controls.
- Hover over links before clicking, or long-press on mobile. The visible text might say “Login to Office 365” while the underlying URL points somewhere else entirely, a mismatch TechRadar’s coverage of Australian scams flags as one of the fastest ways to catch a fake.
- Be wary of shortened URLs (bit.ly, tinyurl, or similar). They hide the destination completely, which is exactly why phishing campaigns love them.
- Look at the authentication result if your email client shows one. Many platforms display a small note about SPF, DKIM, or DMARC status. A failure on any of these, especially DMARC, is a strong indicator the sender’s identity has been forged, since DMARC failures generally mean the domain owner never authorised that email to be sent.
- Treat a QR code in a PDF as a link you can’t preview. Scan it with a URL-previewing app first, or don’t scan it at all.
- Verify through a separate, known channel. Call the bank on the number from a past statement, not the one in the email. Log into your account portal directly rather than through any link.
Technically, these authentication checks trace back to how email itself was built. RFC 5321, the standard governing basic mail transport, never required senders to prove who they claimed to be, which is exactly the gap SPF, DKIM, and DMARC were layered on top of decades later. Organisations that enforce DMARC with a quarantine or reject policy see markedly fewer successful spoofing attempts against their own domain, which is one reason business email security has become a checklist item rather than an afterthought.
Newer phishing formats that slip past old habits
The classic advice, check for typos and dodgy grammar, doesn’t cut it anymore. Phishing has gone multi-channel, and generative tools now produce lures that read as cleanly as a real corporate email, making technical checks more important than grammar spotting.
- MFA prompt bombing: you get hit with repeated authentication push notifications, sometimes a dozen in a row, until you approve one just to make it stop. The risk is real: attackers count on fatigue, not technical skill, to break through multi-factor protection.
- Browser-in-the-browser attacks: a fake pop-up window mimics a genuine SSO login prompt so convincingly it includes a fake address bar and padlock icon. It’s rendered entirely in HTML inside the page you’re already on, so there’s no real browser chrome to inspect.
- HTML link and text mismatches: the clickable text says one thing, the destination says another, sometimes buried inside an otherwise legitimate-looking newsletter template.
- HTML smuggling: malicious code gets assembled inside your browser after the email itself passes every filter clean, since the payload never touches the network as a single flagged file.
- Quishing on mobile: phones make link inspection harder, since there’s no mouse to hover with, and QR codes bypass most link-scanning tools entirely.
What to do if you clicked or received a phishing email
Speed matters more than perfection here. A few fast, correct steps limit the damage far more than a slow, thorough investigation.
- Don’t reply, and don’t click anything else in the email. If you’ve already clicked a link but haven’t entered anything, close the tab and disconnect the device from Wi-Fi if you’re worried about malware spreading.
- Change your password immediately if you entered credentials anywhere, and do it from a different, clean device if possible.
- Revoke active sessions and check MFA methods. Attackers who’ve grabbed a password will try to log in elsewhere; forcing a sign-out everywhere closes that window fast. Techbug’s guide to Microsoft 365 security controls walks through exactly where to find these settings.
- Notify the right people. Tell your bank if financial details were involved, tell your IT team or provider if you’re at work, and report the email through your provider’s phishing button or CISA’s reporting channel.
- Preserve the evidence. Don’t delete the original email until IT or your bank has had a chance to review the headers.
- Escalate to an incident response provider if you’re a business and the account involved had access to financial systems, customer data, or shared drives. That’s the point where a managed IT provider earns its keep. Individuals can find practical next steps in Techbug’s guide to protecting yourself from scams.
Why experience with real incidents changes how you see the risk
Thirty years of combined experience across Techbug’s team means the pattern is familiar: small businesses often assume they’re too small to be a target, which unfortunately is a misconception. Cyberattacks frequently target small operators due to their vulnerabilities rather than size. That figure changes how a managed IT provider prioritises its work.
The businesses that get hurt worst aren’t the ones with the weakest technology. They’re the ones who never trained staff to pause before clicking, and never had a backup that actually worked when it mattered.
A vendor-agnostic approach means recommending the control that actually fits a business, not the one tied to a particular reseller agreement. In practice that means staff training built around real examples, proactive monitoring, ransomware-safe backups, and an emergency response team on call when something does get through.
Individuals versus businesses: why workplace scams look different
A phishing email aimed at an individual usually chases something personal: a bank login, a streaming subscription, a parcel redelivery fee. The damage is contained to that one person’s accounts.
Workplace-targeted phishing plays a different game entirely. It exploits organisational structure, reply-chains, shared calendars, and the fact that staff are conditioned to respond quickly to requests from managers or suppliers. A BEC email doesn’t need to fool everyone in the business, just one person with access to payments or payroll. That’s why finance and HR staff get targeted specifically, and why the same payroll fraud tactics that redirect a wage payment can just as easily redirect a supplier invoice.
Businesses also carry a bigger blast radius. One compromised account can expose customer data, trigger a compliance obligation, or give an attacker a foothold to launch further attacks against clients and partners under a trusted domain name. That’s the core reason a business email security checklist needs to cover both technical controls and staff behaviour, not just spam filtering.
How phishing campaigns actually get delivered
Most phishing falls into one of three delivery patterns, and knowing which one you’re looking at tells you a lot about how targeted the attack is.
Mass campaigns blast the same template to thousands of addresses at once, harvested from data breaches or scraped from public sites.
Spear-phishing narrows the target to a specific person or small group, using real details, a name, a job title, a recent event, to make the email feel personal. These take more effort to craft but convert at a much higher rate because they don’t feel generic.
Targeted or whaling attacks go after a single high-value individual, usually an executive or finance lead, often after weeks of quiet reconnaissance through LinkedIn, company websites, or a previous smaller breach. These are the attacks behind the largest BEC losses, because the attacker already knows the internal language, the usual suppliers, and the timing of real payment cycles before sending a single email.
The psychology behind why phishing works
Phishing succeeds by hijacking decision-making before the analytical part of your brain gets involved. Attackers lean on three levers, and they rarely need more than one.
Urgency compresses your decision window. “Your account will be suspended in 24 hours” doesn’t give you time to think it through, and that’s deliberate. Research into scam tactics shows attackers specifically engineer emotional pressure to stop recipients from pausing to check technical indicators like sender addresses or link destinations.
Fear works the same way through a different door, a threatened fine, a locked account, an alleged security breach on your own profile. Fear narrows focus onto resolving the threat, not verifying its source.
Authority borrows trust that took someone else years to build. An email that appears to come from your CEO, your bank, or the tax office carries instant credibility, and most people are conditioned not to question a request that looks like it comes from someone senior. Combine authority with urgency, “the CEO needs this wire transferred before 3pm”, and you’ve got the exact formula behind most successful BEC fraud.
Spotting spoofed addresses and lookalike domains
Domain spoofing relies on small, easy-to-miss substitutions. A few patterns show up constantly.
Character substitution: “rnicrosoft.com” (with an “r” and “n” standing in for “m”), or “paypa1.com” with a numeral one replacing the letter L. These are built to survive a quick glance.
Subdomain tricks: an address like “[email protected]” looks legitimate at first read because “microsoft” appears early in the string, but the actual domain being used is “security-update.com.”
Extra or missing characters: “amaz0n-orders.com” or “netflix-billing-support.net” add extra words to a real brand name to make an unrelated domain feel official.
Free webmail masquerading as a company: a message claiming to be from “HR Department” but sent from a Gmail or Outlook.com address rather than the company’s actual domain is one of the easiest checks available, and one of the most overlooked.
The safest habit is to type the company’s known web address from memory or a bookmark rather than clicking through, and to check the domain character by character when something feels slightly off.
Using your email client’s own tools to catch phishing
Most email platforms already carry filtering and authentication features most people never look at.
Gmail, Outlook, and most business email platforms display a warning banner when SPF, DKIM, or DMARC checks fail, often worded as “this message failed to authenticate” or similar. That banner deserves attention every single time it appears; a combination of a DMARC failure alongside a spoofed display name is close to a guaranteed sign of external spoofing.
Built-in “report phishing” buttons do more than protect you. Reporting trains the platform’s spam filters and, in a workplace setting, alerts your IT team that a live campaign has reached your inbox, so they can warn colleagues before more people click. Custom mail rules can also flag or quarantine messages where the display name mismatches the sending domain, a setting worth asking your IT provider to configure if it isn’t already active.
For businesses running Microsoft 365, tightening these authentication settings and connecting them to proper monitoring is one of the highest-value security moves available, covered in more depth in Techbug’s overview of IT security services.
Handling attachments and links without getting caught
Never open an attachment you weren’t expecting, even if the sender name looks familiar; verify by a separate channel first if there’s any doubt.
Macro-enabled Office files (.docm, .xlsm) and unexpected .zip or .exe attachments carry the highest risk, echoing the delivery method behind large-scale malware campaigns like Emotet. PDF attachments containing only a QR code deserve the same suspicion as a raw link, since scanning it with your phone’s camera sends you straight to a destination you can’t preview first; a URL-previewing app or a sandboxed viewer is the safer route.
For links, hover on desktop or long-press on mobile before tapping anything, and treat shortened URLs as a red flag by default rather than an exception. If a link demands a login, open the service directly in a new tab instead and log in there.
What years of cleaning up after phishing attacks teaches you
The pattern that stands out isn’t the sophistication of the emails. It’s how predictable the outcome is when a business skips the boring stuff, staff training and a working backup, in favour of chasing the latest security gadget.
One habit beats almost every technical control: build a two-second pause before clicking anything urgent into your daily routine, whether you’re a solo operator or managing a team of fifty. Pair that with one technical control, DMARC enforcement or MFA on your email account, and improve both slightly every few months rather than trying to fix everything at once. Small, consistent upgrades outlast any one-off security overhaul.
— Ru
How Techbug helps businesses stop phishing before it costs them
Techbug is the alternative to waiting until after a breach to get serious about email security. Where most businesses only call an IT provider once a phishing email has already caused damage, working with a managed provider beforehand means the monitoring, backups, and staff training are already running when an attack lands.
Techbug’s managed IT services cover proactive monitoring, ransomware-safe backups, and staff training built around real phishing examples rather than generic slideshows, backed by a vendor-agnostic approach that recommends whatever control actually fits your business, not whatever a reseller agreement pushes. If a phishing email has already landed in your inbox or you’re not sure your current defences would catch the next one, Techbug’s IT security services page is the place to request a review and find out where the gaps actually are.
Where to check the facts yourself
- CISA: Recognise and report phishing, the primary government reference for signs of phishing and reporting steps.
- RFC 5321, the technical standard behind email headers and sender verification.
- SOCSimulator’s phishing email examples, a working analyst’s breakdown of real templates.
- Spamhaus on the Emotet aftermath, showing how attachment-based phishing scales into malware campaigns.
Sources
- Scams in Australia — TechRadar
- Recognize and report phishing — CISA
- Phishing email examples analysed by a SOC analyst — SOCSimulator
- Emotet email aftermath — Spamhaus