Most of the incidents we handle at Swiss SMEs do not start with a hacked firewall. They start with an email. Someone clicks a link, enters their password on a convincing fake page, and from that moment the attacker has a valid account. Everything that follows, data theft, invoice fraud, encryption, builds on that single click.
Technical filters catch a large share of phishing emails. But not all of them, and the most dangerous ones are exactly those that get through: well written, tailored to the company, free of spelling mistakes. The days when phishing could be spotted by clumsy language are over. That is why everyone in the company should know these six warning signs. None of them proves an attack on its own. But if one applies, pausing is right, and if two apply, reporting is right.
Warning sign 1: Time pressure and threats
"Your account will be locked in 24 hours." "Final reminder before debt collection." "Please confirm today or your delivery will be cancelled." Phishing relies on you reacting instead of thinking. Urgency, fear and the prospect of a loss switch off precisely the part of the brain that would otherwise ask whether this is plausible.
Real companies and authorities rarely set deadlines of hours and almost never threaten immediate consequences by email. The rule of thumb: the more an email pushes, the more time you should take. Nobody loses an account because they waited an hour and asked a quick question.
Warning sign 2: The sender is not quite right
The display name says "Microsoft" or "John Smith, Management". The actual address behind it says something else. On a phone, the address is often not visible at all, and attackers count on exactly that. Tap the sender or hover over it and look at the address.
Watch for domains that are almost right: a swapped letter, an extra word, a different ending. "goldoak-ch.com" is not "goldoak.ch". Just as suspicious: the reply address differs from the sender address. And even a correct address is no proof, because if a supplier's account has been hijacked, the phishing email really does come from them. Then the other signs have to help.
Warning sign 3: The link goes somewhere else
The text of a link and its destination are two different things. "Sign in now" can lead anywhere. On a computer, hover over the link without clicking and read the address that appears at the bottom of the window. On a phone, press and hold the link until a preview appears.
It is suspicious when the Microsoft 365 login page is not on a Microsoft domain, when the address is a long string of random characters, or when a short link hides the destination. The safest option is not to use the link at all: open the service through the address you know or your bookmark and check there whether anything is actually pending. If the supposed invoice or account lock does not exist there, it was phishing.
Warning sign 4: Unexpected attachments, macros and QR codes
An invoice you are not expecting. A "document" that only opens if you enable editing and allow macros. A job application as a ZIP file. An HTML file that shows a login form when opened. Attachments are the classic way to get malware onto a computer, and a request to enable macros or content is almost always an alarm signal.
Newer, but now common: a QR code in the email that you are supposed to scan with your phone, for example to confirm MFA or retrieve a document. The trick behind it: the phone is often less protected than the company computer, and the link inside the QR code is checked by no mail filter. A QR code in an email almost never has a legitimate reason.
Warning sign 5: An unusual request from the boss or a supplier
"I'm in a meeting and can't take calls. Can you urgently make this transfer?" "Please buy five gift cards and send me the codes." "Our bank details have changed, please pay the open invoice to the new account." These emails contain neither link nor attachment and pass every filter. They target people, not technology.
The pattern is always the same: an authority figure or a known business partner, a deviation from the normal process, and a reason why a call back is not possible right now. The only effective countermeasure is a rule that applies to everyone, including management: payments, changed bank details and gift card purchases are confirmed over a second channel. A call to the known number, not the one in the email. Always. Anyone who finds that insulting has not understood the problem.
Warning sign 6: The email does not fit the context
You receive a payment request from a service you do not use. A parcel notification although you ordered nothing. A reply to an email thread from two years ago, suddenly with a link. A greeting that does not match your relationship with the person, or a tone that does not sound like them. A document that was "shared" without anyone mentioning it.
This sign is the vaguest, but often the most important. It is the gut feeling that something is off. Attackers know names, logos and processes, but they rarely know the context: what is currently going on, who talks to whom and how, what is normal. If an email triggers that feeling, that is reason enough not to act on it but to report it.
What to do when in doubt
Do not click, do not reply, do not open anything. Replying matters: even a question back to the sender confirms to the attacker that the address is active and someone is reading. Instead, report the email to IT or to whoever is responsible for this in your company. Many mail clients have a button for it. If there is one, use it, because it gives IT the email with all the technical details.
If you are unsure whether the email is genuine, ask the supposed sender, but over a channel you choose yourself: the phone number from the address book, not from the email. And if it is a colleague, just walk over.
What to do after a click
It happens. To experienced people too, and in IT departments. What matters is not whether someone clicks but how quickly it is reported. Someone who enters a password on a fake page and reports it immediately usually causes no damage at all: change the password, end the sessions, done. Someone who keeps quiet for three days out of embarrassment gives the attacker a three-day head start.
That is why the most important rule for companies is not "don't click" but "report immediately, and nobody gets blamed for it". A company where employees are afraid to admit a wrong click has a bigger security problem than one where someone clicks now and then and says so five minutes later. After a report, the order from our emergency plan for the first 60 minutes applies: lock the account, end sessions, change the password, check what happened in the meantime.
What technology has to take over
Employees are an important sensor, but they must not be the last line of defence. Three things belong on the technology side:
- MFA everywhere, phishing-resistant where possible. With passkeys or hardware keys, a stolen password is useless because the second factor is tied to the real domain. SMS codes and push confirmations, on the other hand, can also be phished with a bit of effort.
- Mail filtering and sender protection. SPF, DKIM and DMARC make sure nobody can send genuine-looking emails in your name, and a good filter takes most of the work off employees' shoulders.
- Detecting and blocking what gets through. If an account is taken over despite everything, it shows up as logins from unfamiliar countries, new forwarding rules or unusual behaviour on the computer. That is exactly what Spectacles is built for: it detects such patterns on endpoints and in cloud accounts automatically, blocks them and can isolate an affected system before the attack spreads.
Conclusion
Phishing is no longer recognised by spelling mistakes but by patterns: pressure, wrong sender, wrong link destination, unexpected attachment, unusual request, missing context. Anyone who knows these six signs will spot most of the attacks that get past the filter. And anyone who knows that a quick call to IT after a wrong click is always the right move turns an incident into a footnote.
If you want to know how well your company is set up against phishing, from MFA to mail filtering to detection, a Security Health Check shows you the gaps with priorities. And if you want training for your team that works without blame, talk to us about it in a consulting session.