A phishing email combines a believable sender, a reason to act now and a link or attachment. Look at the real sender address, the reply-to field and where links actually lead.
What this means in practice
A useful test is to ask who would act on this tomorrow morning and what they would need. If the answer is unclear, the gap is organisational rather than technical, and that is usually the cheaper one to close.
Key actions
- Check the sender domain, not the display name
- Hover over links before clicking
- Be wary of unexpected attachments
Next steps
Teach staff the few signs that matter rather than long lists. Keep the first version short. A one-page routine that people follow beats a long document nobody reads.