How do you spot a phishing email? Red flags and a free trainer

Most phishing emails give themselves away in four places: the sender, the request, the links and the pressure. Here are the red flags to check, how the common Australian scams work, and a free trainer you can paste a suspicious email into or practise on with your team.

Why phishing still works

Phishing is an email, text or call that pretends to come from someone you trust so you’ll hand over a password, a code, money or access. The Australian Cyber Security Centre (ACSC) warns that these messages can look genuine and convincing. Looking for spelling mistakes isn’t enough. Many phishing emails are well written, and some are sent from a genuine account that has already been taken over.

The numbers show why it’s worth a few minutes of training. In 2025, phishing was the most reported scam to Scamwatch, with 65,361 reports, according to the ACCC and the National Anti-Scam Centre. In the combined data from Scamwatch, ReportCyber and the other organisations that share scam reports with the National Anti-Scam Centre, reported losses to phishing were $97.6 million. Payment redirection, a close cousin that often targets businesses, accounted for a further $166.8 million.

The good news is that phishing relies on a small set of tricks, and once you know them most attempts become obvious.

The 30-second check: four questions

Before you click, reply, pay, scan or open anything, ask:

1. Who is it really from? Look past the display name at the actual address, and at where a reply would go.
2. What does it want me to do? Sign in, pay, change details, share a code, buy something, open a file, scan a code or call a number. The request is the most important red flag.
3. Where do the links really go? The text you see can say anything. The real address is what counts.
4. How hard is it pushing? Deadlines, threats and secrecy are there to stop you checking.

If the answer to the second question is anything involving money, passwords, codes or files, verify the request through a separate channel even if everything else looks right.

The red flags, one by one

1. The sender doesn’t add up

The display name ("IT Service Desk", "Accounts", your CEO’s name) is typed by whoever sends the email, so it proves nothing. Scamwatch’s warning signs include sender details that don’t match the business or agency the message claims to be from.

• The address is on a domain that isn’t the organisation’s, or on a free email service for something "official".
• Replies go to a different address from the sender (a different Reply-To).
• The display name contains an email address that isn’t the real one.

Check: open the sender details and read the full address (on a phone, tap the name).

2. A lookalike domain

Scamwatch warns about website addresses that are only slightly different from the real one. Common tricks:

• A swapped character: a zero for an "o", "rn" for "m", or a missing letter.
• A trusted name in front of someone else’s domain. In yourbank.com.au.secure-login.example, the real owner is secure-login.example, not your bank.
• A trusted name with extra words: yourbank-verify.example.
• Characters from other alphabets that look like Latin letters.

Check: read a domain from the right. The part just before the ending (.com.au, .com, .gov.au) is who owns it. Everything to its left can be made up.

3. Link text that doesn’t match the link

In an email, the visible text of a link and the address it opens are separate. "www.mygov.au" can open anywhere.

Check: hover over the link on a computer, or press and hold on a phone, and read the real address before you tap. If it differs from the text, or uses a link shortener, don’t use it. Go to the site yourself.

4. It asks you to sign in or confirm a password

"Your password expires today", "Your mailbox is full", or "A document has been shared with you, sign in to view". These lead to a fake sign-in page that captures what you type. The ACSC’s warning signs include requests for passwords, authentication codes or personal information.

Check: never sign in from an email link. Open the app or your bookmark and see whether the alert is really there.

5. It asks for a code, or to approve a sign-in

Your one-time code is the last thing protecting your account. Scamwatch is blunt: never share passwords or one-time codes with anyone who contacts you unexpectedly, even if they claim to be from your bank. A related trick, device-code phishing, sends you a code to type into Microsoft’s genuine sign-in page. The attacker started that sign-in on their own device, so when you enter the code and complete your usual MFA, Microsoft signs in the attacker’s session as you. Hovering over the link shows a real Microsoft address, which is why the request itself is the red flag. We explain it, and the Conditional Access setting that blocks it, in device-code phishing.

Check: if you didn’t start a sign-in, don’t approve it and don’t read out or enter any code. Tell IT.

6. Bank details have "changed"

A supplier’s or employee’s bank details are suddenly different, often in an email that looks like it’s from the real supplier. This is payment redirection, the second-costliest scam type by reported losses in Australia in 2025, after investment scams.

Check: before paying a new or changed account, phone the supplier on a number you already hold (not one in the email) and confirm the details. Our Christmas invoice fraud call-back checklist turns this into a process for accounts teams.

7. Gift cards, crypto or another odd way to pay

"I’m in meetings and can’t talk. Can you buy five gift cards for a client and send me photos of the codes?" Genuine managers don’t run purchasing like this. Once the codes are shared, the money is gone.

Check: confirm any unusual purchase request in person or by phone with the person who supposedly sent it.

8. An attachment that asks you to "Enable Content"

Documents that ask you to click Enable Content or Enable Editing, macro-enabled files (.docm, .xlsm), disc images (.iso, .img), shortcuts (.lnk), scripts, HTML attachments and password-protected zips are common ways to deliver malware. Microsoft describes macros as a common way for attackers to deploy malware and ransomware, and since 2022 Office on Windows blocks macros in files from the internet (such as email attachments) by default. So a document that tells you to change its file properties or "unblock" it is just as suspicious as one asking you to enable content.

Check: don’t enable content on a document you weren’t expecting. Ask the sender, through another channel, whether they sent it.

9. A QR code instead of a link

"Scan this QR code to keep your MFA working." The ACSC calls this quishing. A QR code hides its link, and scanning it on a personal phone takes you outside your work security controls.

Check: be very wary of QR codes in email, especially about sign-in, MFA or payments. Go to the service directly instead.

10. Pressure, threats and secrecy

Every flag above is usually wrapped in pressure: "within 24 hours", "your account will be suspended", "keep this between us". The ACSC lists pressure to act quickly, threats of serious consequences and requests to skip normal security steps as warning signs.

Check: treat urgency as a reason to slow down. A genuine request will still be genuine after a five-minute phone call.

11. Generic greetings and prizes

"Dear customer", "you’ve won", "your parcel is on hold, pay the small fee". On their own these prove little, but with a link or a payment request they are typical of mass phishing. The ACSC lists generic greetings like "Dear customer" among its warning signs, and Scamwatch’s advice is to reach an organisation through its own app or portal, never through a link in a message.

Check: check parcels, refunds and tolls in the organisation’s own app or website, never through the message.

Real patterns, explained (with the links removed)

These are typical of what Australian organisations receive. The domains are made-up placeholders, so nothing here is clickable.

The supplier bank change. From "Accounts, Northwind Supplies", with replies going to a different domain. "Our banking details have changed following an audit. Please pay all outstanding invoices to the new account below. Keep this confidential while the change is finalised." The red flags are the reply address, the change of details, and the pressure plus secrecy. The fix is a phone call to the number already in your system.

The password expiry. From "IT Service Desk" at a domain one character off your own, saying "Your password expires today". The visible link shows your real domain, but hovering shows yourcompany.com.password-check.example. The red flags are the lookalike sender, the mismatched link and the sign-in request.

The boss on a free email account. "Alex (CEO)" from a personal webmail address wants gift cards, can’t talk, and asks you to keep it quiet.

The MFA code call. "We blocked a sign-in to your account. Our security team will call. Read them the verification code we just sent." No security team ever needs your code.

The QR code re-registration. "Scan the QR code with your phone camera and verify your account within 48 hours or we will lock it." The QR code hides the destination, and the deadline does the rest.

All of these are in the trainer above as practice emails, along with one genuine email, because spotting what’s normal is part of the skill.

How to check the headers (when the email looks right)

When everything looks genuine, the message details can help. In most email programs you can open "View message details" or "View source". Look for:

• From and Reply-To: do they match, and are they on the organisation’s real domain?
• Authentication-Results: entries like spf=fail, dkim=fail or dmarc=fail mean the receiving system couldn’t confirm the message came from the domain it claims. A pass doesn’t prove the email is safe, because attackers can send from domains they own or from a compromised real account.

Paste those lines into the trainer along with the message text and it will flag SPF, DKIM, DMARC or compauth failures and a mismatched Reply-To. Like the rest of the trainer, it points out red flags; it can’t confirm an email is safe.

Whether a lookalike of your domain gets through also depends on your own domain’s email authentication. If you run Microsoft 365, our guide to SPF, DKIM and DMARC for a .com.au domain shows how to stop others sending as you.

What to do with a suspicious email

1. Don’t click, reply, scan, open or pay.
2. Report it inside your organisation. Use your email’s Report button if it has one (Outlook in Microsoft 365 does) or forward it to IT as instructed. Reporting helps them remove the same email from everyone else’s inbox.
3. Verify the request separately if it might be real: phone the person or organisation on a number you already have.
4. Report scams to Scamwatch at scamwatch.gov.au. If you have lost money or data to a cybercrime, or a business account was compromised, report it at cyber.gov.au/submit-a-report.

If you already clicked or entered details:

1. Change the password for that account (and anywhere else you reuse it) from a trusted device.
2. Tell IT straight away. They can sign the account out of all devices and remove forwarding or inbox rules an attacker may have set up.
3. If bank or card details were involved, call your bank on the number on your card or its website.
4. Report it at cyber.gov.au/submit-a-report. For business email compromise, the ACSC’s guidance is to report to your bank or financial institution and to ASD immediately.

For the full checklist after an account takeover, see business email hacked: what to do in the first hour.

A simple anti-phishing routine for your organisation

Some phishing will always reach people. What matters is a routine that makes the dangerous requests hard to act on.

• A call-back rule for payments. Any new or changed bank details are confirmed by phone on a known number before the first payment, with no exceptions for urgency or seniority.
• No codes, ever. Everyone knows that IT, the bank and the boss will never ask for a one-time code or ask you to approve a sign-in.
• One way to report. Staff know where the Report button is, and reporting is thanked, not blamed, including "I clicked it".
• Practice on realistic examples. Short, regular training on the patterns above, using tools like the trainer in this post and, if you want to measure it, a simulated phishing campaign.
• Email security underneath. Filtering, link and attachment checking, and SPF, DKIM and DMARC on your own domains reduce how much reaches people in the first place.

Our security awareness training covers the human side. Email protection covers the filtering and domain authentication.

Key takeaways

• Check four things before acting: the real sender, the request, the real link destination, and the pressure.
• Any request involving money, passwords, codes, gift cards or "enable content" means stop and verify through a channel you already trust.
• Read domains from the right. The part before the ending is the owner, and anything to its left can be faked.
• Urgency and secrecy are red flags in themselves. Real organisations give you time.
• Report suspicious emails inside your organisation, and report scams to Scamwatch and losses at cyber.gov.au/submit-a-report.
• Practise. The trainer above is a learning aid, not a filter. It runs in your browser, never opens a link and sends nothing, so it’s safe to use with your team.

Sources

• Australian Cyber Security Centre, Learn about phishing scams (last reviewed 9 April 2026): warning signs, quishing and what to do.
• Scamwatch, Phishing scams: warning signs, checking who it really is, and never sharing one-time codes.
• ACCC and National Anti-Scam Centre, Continued action critical to combat fraud as annual scam losses exceed $2 billion (30 March 2026): phishing was the most reported scam to Scamwatch in 2025 (65,361 reports), and the top combined losses by scam type.
• Scamwatch, Targeting scams report: 2025 combined losses by scam type (payment redirection $166.8 million, phishing $97.6 million), drawn from Scamwatch, ReportCyber and other data-sharing organisations.
• Australian Cyber Security Centre, Recover from business email compromise: report to your bank and ASD immediately, sign out of all devices, remove rules you don’t recognise.
• Australian Cyber Security Centre, Submit a Report.
• Microsoft Learn, Macros from the internet are blocked by default in Office: why macros are blocked, and the versions affected.
• Microsoft Security Blog, Inside an AI-enabled device code phishing campaign (6 April 2026): how device-code phishing works.
• Microsoft Learn, Block authentication flows with Conditional Access policy: blocking the device code flow.
• Microsoft Learn, Set up DMARC to validate email in Microsoft 365: Authentication-Results fields.