A payroll update arrives at 4.47 pm on a Friday. It appears to come from a senior manager, asking you to review a document before close of business and includes a familiar-looking sign-in link. The message may look ordinary enough to act on quickly. That is exactly what makes phishing effective.
Knowing how to recognise phishing emails is not about becoming suspicious of every message. It is about slowing down when an email asks you to click, sign in, pay, share information or change a normal process. For Australian organisations, this is a practical workforce skill that reduces the chance of account compromise, fraud and data loss.
Phishing is a form of social engineering. Rather than breaking through a technical control, the attacker tries to persuade a person to give them access. An email may imitate a supplier, bank, government agency, cloud service, colleague or executive. It may contain a malicious link or attachment, or direct the recipient to a fake sign-in page designed to capture their credentials.
The old examples were easy to spot: poor spelling, strange formatting and promises that were clearly too good to be true. Modern phishing attempts are often more polished. Attackers can copy company branding, use publicly available staff names and write messages that fit a real business context.
That means one warning sign alone does not prove an email is malicious. A legitimate supplier might change its bank details, and a real colleague may send a short, urgent request. The stronger approach is to look for inconsistencies, then verify the request through a trusted channel before acting.
Most phishing emails create pressure. They claim an invoice is overdue, an account will be closed, a delivery has failed, a document needs immediate review or the CEO needs help with a confidential payment. Urgency is designed to bypass normal judgement.
Train staff to pause when a message involves an unexpected request, even if it appears to come from someone they know. The following signs are worth checking together:
Spelling and grammar can still be clues, but they are no longer reliable tests. A well-written email can be fraudulent, while a genuine message may contain a typo. Focus on the request, the sender, the destination and whether the message follows normal business practice.
Display names are easy to imitate. “Accounts Team” or the name of a trusted executive may look reassuring in an inbox preview, but the actual email address tells a different story.
Staff should check the domain after the @ symbol. An address using a free email service, a misspelt business name or an unrelated domain is a clear concern. Be careful with lookalike characters too. A domain with an extra letter can be missed when people are scanning quickly.
However, a correct-looking address is not absolute proof. A real mailbox can be compromised, and attackers may use legitimate email platforms. This is why the content and context of the request still matter.
Credential phishing commonly uses a familiar pattern: an email says a shared file, voicemail, invoice or account alert is waiting, then asks the recipient to sign in. The linked page may closely resemble Microsoft 365, Google Workspace or another service used by the organisation.
Before entering a password, staff should ask whether they expected the notification and whether the address bar shows the genuine service domain. A safer habit is to open the usual service separately using a saved bookmark, approved application or manually typed address. If the document or alert is legitimate, it should normally be available there.
Multi-factor authentication provides valuable protection, but it does not remove the need for care. Some phishing campaigns use a fake sign-in page to capture credentials and then immediately request a multi-factor code. Staff should never approve an unexpected authentication prompt simply because it appears after they entered a password.
When an email involves payment changes, bank details, gift cards, payroll information, client data or an unusual request from an executive, verification should be a required business step rather than a personal judgement call.
Do not reply to the suspicious email or call a phone number included in it. Instead, contact the person or organisation through a known number, established contact record or separate internal channel. A quick Teams message to a manager, or a call to a supplier contact already held in the finance system, can prevent a costly error.
This is particularly relevant for business email compromise. In these attacks, criminals impersonate or take over a trusted mailbox and send believable payment instructions. The email may contain accurate project names, invoice references or writing styles taken from earlier correspondence. Strong approval workflows and independent verification are more reliable than trying to judge the email by appearance alone.
Employees are more likely to report suspicious messages when the process is clear, quick and blame-free. They should know exactly where to send a suspected phishing email, whether that is an IT service desk, a dedicated reporting mailbox or an approved reporting function in the email client.
A useful reporting process should tell staff not to forward a suspicious message externally, click links to investigate or delete it before the organisation has had a chance to review it. IT or security teams may need the original email headers and attachments to identify whether other people received the same campaign.
Just as importantly, encourage reporting even when someone has clicked. Delayed reporting gives an attacker more time to use stolen credentials, move through systems or target other staff. A calm response works best: disconnect if instructed by IT, change credentials through an approved route, report what happened and follow the incident response process.
A once-a-year awareness session is rarely enough. Phishing tactics change, and people forget details when training is disconnected from their daily work. Short, scenario-based learning is more practical because it shows staff the decisions they are likely to face: a fake shared document, a supplier payment update, an unexpected QR code or a rushed request from a senior leader.
Training should reflect different roles. Finance teams need clear controls around payment and account changes. HR teams handle personal information and may receive fake job applications or payroll requests. Frontline staff may work mostly from mobiles and need simple ways to verify messages when they are away from a desktop. New starters need the organisation’s reporting process from day one.
For organisations managing training internally, downloadable SCORM-compatible microlearning can be placed in an existing learning management system and aligned with local policies and procedures. This keeps delivery records and content control with the organisation, while allowing phishing scenarios to be refreshed as risks change.
The most useful habit is also the simplest: pause before acting on an unexpected email. Check who sent it, consider what it is asking for, verify anything unusual through a trusted channel and report it early. That small pause gives people the space to make a safer decision.
