Phishing email warning signs are easy to learn, and a team that knows them stops most fake emails before any harm is done. A phishing email is a message that pretends to be a bank, a supplier, a government office or a boss. Its goal is to make you click, open a file or hand over a password. This guide lists the common tells and sets out what staff should do in the first five minutes.
The six tells in a fake email
The Cyber Security Agency of Singapore (CSA) lists six signs to look for. You do not need all six. One is enough to stop and check.
- Mismatched details. The sender address or the website address does not match the real one.
- Urgent or threatening words. Lines such as "urgent action required" or "your account will be terminated" are meant to rush you.
- Rewards that sound too good. A surprise prize or a deal that needs you to act now is a warning.
- Requests for private data. Login details, card numbers, bank details or ID numbers should never be sent by email.
- Emails you did not expect. An invoice for something nobody ordered is a classic example.
- Odd attachments. Unfamiliar files, strange file names and uncommon types such as .exe files are risky.
Do not rely on bad spelling to spot a fake. A clean, well written email can still be a scam, so check the sender, the link and the request every time.
Check the sender and the link
Start with the sender. Look at the full address, not just the display name. Compare it with an address you already trust, such as one from a past invoice or the official website. A name that reads "Accounts Team" can sit on top of an address that has nothing to do with your supplier.
Next, check the link without clicking it. On a computer, hover your mouse over the link and read the address that appears. On a phone, press and hold the link. Look for swapped letters. The Singapore Police Force and CSA give the example of "paypa1" in place of "paypal", where the number 1 stands in for the letter l.
Criminals use lookalike addresses because a quick glance often misses them. They may send you to a fake page that asks you to reset a password. Anything you type on that page can go straight to them.
Treat attachments and secret requests as red flags
An attachment you did not expect deserves extra care. Some files hide software that steals saved passwords and other private data. If a colleague or supplier sends a file you were not waiting for, confirm it through another channel first. A short phone call is enough.
Staff should also know the simple rule about secrets. Most real organisations will not ask for your password, card details or bank login over email. If an email asks, treat it as a scam until you have proved otherwise.
A good habit for any request that involves money or logins is to verify it with a known contact. Use the phone number or address on the organisation's official website. Never use the contact details printed in the suspect email, because those may lead to the criminal.
What to do in the first five minutes
Speed matters, and so does staying calm. Use this order.
- Stop. Do not click, reply, or open any file in the email.
- Tell someone. Message your manager or whoever looks after IT. Others may have received the same email.
- Verify the request. Contact the real organisation using details from its official website.
- Delete the message only when you are confident it is a scam, and after you have reported it as set out below.
- Ask if unsure. If you cannot tell whether something is a scam, call the 1799 ScamShield helpline, which CSA says runs 24 hours a day.
If someone has already clicked or typed a password, act at once. Change the password straight away. Change it on any other account that used the same one. Run a full scan with up to date anti-virus software if a link was opened or a file was downloaded.
If card or bank details were shared, alert the bank promptly and watch the accounts for charges you do not recognise. If money was lost, file a police report.
Where to report a phishing email
Reporting helps protect other people, so do it even if nobody was fooled. CSA advises reporting the attempt to the organisation that was impersonated. It also asks you to report it to SingCERT, the Singapore Computer Emergency Response Team.
SingCERT takes reports through an online form. If your security settings stop you from forwarding the email, send a message without the suspicious attachment to [email protected]. SingCERT will follow up with you.
For a business, write the steps down. Name who staff should tell, where the report form is, and who may approve payments. A one page checklist on the wall or in the shared drive costs nothing and saves time when an email lands at a busy hour.
Make safe habits routine
Training works best when it is short and regular. Show staff a real example every few months and ask what gave it away. Encourage questions, and never punish someone who reports a mistake quickly. A fast report is worth far more than a hidden error.
Two simple controls help a great deal. First, use a different password for every account, and consider a reputable password manager. Second, turn on two factor authentication wherever it is offered, so a stolen password alone is not enough. The Singapore Police Force and CSA recommend both.