How do you spot a phishing email or text, and what should staff do with it?

Ascent Vision · Published October 30, 2026

Phishing messages try to get a click, a password or a payment detail out of you. CISA lists red flags: "strange or unexpected requests, urgent language or suspicious links". Do not reply or use any phone number or link inside the message. Check it by hovering over a link without clicking and by contacting the sender through a number you already have. Then report the message to whoever your business has named, and delete it.

The signs

The FTC describes a typical phishing message as an email or text that seems to be from someone you know and asks you to click a link or give your password, business bank account or other sensitive information. Signs to look for:

A strange or unexpected request, which CISA lists as a red flag.
Urgent language. The FTC says these messages pressure you to act now, or something bad will happen.
A link or attachment you did not expect.
A sender address that is slightly off. The FTC says you can right-click the sender's address to see the true one, and that an address that does not look like a valid company address can be a red flag.
A familiar logo or name. The FTC notes it is easy to spoof logos and make up fake email addresses, so a logo proves little.

Even a known contact can be a fake

CISA warns that phishing messages may include personal or company-specific details, and may appear to come from known contacts whose accounts were compromised. A message that looks right but asks for something unusual is still worth checking.

How to check a message safely

Hover the mouse over a link without clicking it to see where the address leads (CISA).
Do not reply, and do not use a phone number or link inside the message (CISA).
Look up the business's phone number with a search engine, or use a contact method you already have for someone you know (CISA).
If a message asks you to log in to an account, go to the company's website on your own rather than using its link (FTC).
Calling the vendor, colleague or client on a number you know to be correct is the FTC's advice for confirming a request.

What staff should do with it

If someone suspects phishing, CISA says to change account passwords immediately and to report and delete the message. The FTC adds: talk to colleagues, because phishing attacks often happen to more than one person in a company; tell the company or person who was impersonated; forward the email to reportphishing@apwg.org; and report it to the FTC at ReportFraud.ftc.gov.

If someone already clicked a link or opened an attachment, the FTC's advice under "Limit the damage" is to disconnect any infected computer or device from the network and change any compromised passwords. If a password was typed into a fake page, the related answer on a hacked business email account covers the first steps.

Make reporting normal

CISA says once-a-year training is not enough, and that employees should know to whom and how to report suspicious emails. It suggests naming someone to track new threats and share updates between trainings, and notes that an IT provider, trade association or nonprofit may offer no-cost training materials.

As general advice, name one person and one place to send suspect messages, and thank people who report, including for false alarms. A team that fears blame is more likely to stay quiet. Payment-change scams have their own related answer on fake invoices, and the related answer on basic cybersecurity steps has the wider checklist.

Sources

Ongoing technical support

The site goes down, email stops arriving, a domain is about to lapse, nobody knows the password. Many owners do not have a technical person. We are that person, for everything we build and the things you already have.

See the service Work with us