How to recognise a phishing email before it becomes an incident.

Why does a phishing email look credible?

An attacker does not have to defeat a technical control if they convince a user to click, enter a password, or approve a payment. The message often uses real context: a supplier's name, a project, an invoice, a login link, a QR code, or the pressure of an urgent decision.

Checklist for recognising phishing emails

An unusual request, address or time pressure calls for a pause and verification through a known channel. Correct language, logos, HTTPS and a familiar sender do not establish authenticity.

• Sender: the domain differs by one letter, uses a free mailbox or does not match previous correspondence.
• Content: there is time pressure, a threat of consequences, confidentiality or a request to bypass the normal procedure.
• Links: inspect the full address without opening it; short links and QR codes can hide the destination. On a phone, the full address may be harder to inspect. Use the company reporting function, or contact IT through a previously known channel if none is available. Do not open a page just to assess it.
• Attachment: the file is unexpected, asks to enable macros, has a double extension or comes from an unknown source.
• Decision: the message requires a transfer, account change, password reset, MFA code or document download.

What not to do after receiving a suspicious message

The worst-case scenario is testing links yourself and hiding the error. The company should clearly tell users that stopping the process and reporting a suspicion is expected behaviour.

• Don't click a link or enter a password, even if the message looks like Microsoft 365, a bank, or a provider.
• Don't open the attachment if it wasn't expected or the sender is pressing for an immediate response.
• Do not transmit your MFA code, token, payment details or customer data files via email.
• Don't respond to a suspicious message if you can confirm the matter through a known phone number or other channel.
• Do not delete messages before reporting, as they may be needed for header, link and recipient analysis.

What should a company have apart from training?

Think before U click works when the user has process support. Simply asking for caution won't be enough if a company doesn't implement MFA, secure reset, email protection, and a clear escalation path.

When should a company review email security and user awareness?

A review is useful when suspicious messages increase, MFA exceptions remain, sign-ins are not analysed or the company cannot tell whether employees report incidents quickly enough. It is a focused project for IT, finance, HR and management to reduce account takeover and payment-fraud risk.

What to do after clicking a suspicious link

Stop interacting and report promptly through a known channel. Say whether you entered data, approved a prompt, ran a file or sent money. A click alone does not confirm account compromise; IT selects actions based on the event and available evidence.

• Report through a known channel and preserve the original message and action time; do not reopen the link or attachment.
• After credential disclosure or a suspicious approval, IT secures the account, revokes sessions and checks MFA methods; perform resets from a trusted device.
• IT reviews sign-ins, mailbox rules and delegations, sent messages, app consents and data access.
• If a suspicious file ran or infection is suspected, IT isolates the device under the response procedure and preserves evidence.
• Pause suspicious payments and verify details through a previously known contact. If money was sent, contact the bank and incident team immediately.

How Virtline builds phishing resilience

Virtline combines awareness training with a review of technical controls. We check MFA, Microsoft 365, mail flow, mailbox rules, user roles and response procedures, then prepare an action plan.

• Review MFA, Conditional Access, mailbox rules, app consents and login anomalies after a simulated or real click.
• Build role-based examples for finance, HR, management, helpdesk, sales and administrators.
• Define where users report suspicious messages and how IT preserves evidence for analysis.
• Connect training results with Microsoft 365 hardening, SOC/SIEM alerts and incident-response procedures.
• Prepare a security-awareness improvement plan for recurring patterns, high-risk roles and technical controls.

Technical controls and reporting workflow

Connect awareness training to the technical controls that determine whether a click becomes an incident: MFA, mailbox rules, app-consent policies, endpoint protection and a tested reporting workflow.

• Collect recent suspicious messages, user reports and phishing simulation results.
• Identify high-risk roles and mailboxes before choosing training scenarios.
• Decide which first technical control should be improved after the awareness review.
• Confirm who receives reports, preserves evidence and has authority to restrict access when account compromise is suspected.
• Prepare a short human-risk reduction programme covering awareness, Microsoft 365 hardening and incident response.

Evidence that should remain after phishing protection is implemented

After the project, the company needs maintainable material that can be shown to management, an ISO 27001 auditor or a customer. Training slides alone are insufficient when ownership and control effectiveness are unclear.

• MFA coverage for individual users and administrators, plus a review of shared-mailbox delegations; block direct sign-in to shared mailboxes.
• Map of high-risk roles and phishing scenarios matched to their business processes.
• Procedure for reporting a suspicious message, clicked link, entered password and payment fraud.
• SPF, DKIM and DMARC support domain authentication but do not establish that message content is trustworthy or stop every lookalike-domain or compromised-mailbox message.
• A human-risk reduction programme covering training, Microsoft 365 corrections, monitoring and a first-response exercise.

Measurable outcome: phishing readiness

A phishing checklist reduces real business risk only when it changes behaviour under pressure. The goal is to stop false payments, credential theft, mailbox takeover, data leaks and delayed incident reporting.

Related protection areas

Effective phishing resilience combines user behaviour, email configuration, social-engineering tests and current knowledge.

Contact

Connect the user checklist, email controls and rapid response.

Sources and further reading