How to Spot a Phishing Email: Real Examples for Small Businesses

Zac Tassone

Published 13 October 2026 · Updated 26 October 2026

To spot a phishing email, check four things before you click anything: who really sent it, whether it creates urgency or pressure, where the links actually go, and whether the request is unusual for that sender. Most phishing emails fail at least one of these checks. If something feels off, verify the request by phone using a number you already have, not one in the email.

Phishing is still one of the most common ways attacks on small businesses begin. Below are the warning signs to look for, six realistic examples of what lands in Australian business inboxes, and what to do if someone in your team clicks.

Want fewer phishing emails reaching your team? Our managed IT security services add stronger email filtering and 24/7 monitoring, or start with a free IT Health Check.

The warning signs of a phishing email

No single sign proves an email is phishing, but the more of these you see, the more suspicious you should be.

1. The sender address does not match

Look past the display name to the actual email address. A message showing “Microsoft 365” might come from a random Gmail account, or from a domain that is one letter off a real one, such as “rnicrosoft” instead of “microsoft”. Supplier names can be copied exactly while the address behind them is completely different.

2. Urgency, fear or pressure

Phrases such as “your account will be closed today”, “payment overdue, final notice” or “urgent, please action before 5pm” are designed to make you act before you think. Legitimate organisations rarely threaten immediate consequences by email.

3. Links that go somewhere unexpected

On a computer, hover your mouse over a link (without clicking) to see the real address. On a phone, press and hold. If a “Microsoft” link goes to an unfamiliar domain, or a long string of random characters, do not open it.

4. Unexpected attachments

Be wary of invoices, remittance advices, voicemails or “secure documents” you were not expecting, especially HTML files, zip files or documents that ask you to “enable content”.

5. Requests to change payment details or buy gift cards

Any request to update bank details, send a payment urgently or buy gift cards should be confirmed by phone, every time, no matter who it appears to be from.

6. A login page after clicking a link

If clicking a link takes you to a page asking for your Microsoft 365 or bank password, stop. Close the page and go to the service directly by typing its address or using a bookmark.

Real-world examples small businesses receive

These examples are based on common patterns seen in Australian business inboxes. Names and details are generic, but the tactics are real.

Example 1: The password expiry notice

“Your Microsoft 365 password expires today. Click here to keep your current password.”

This is one of the most common phishing emails. The link leads to a convincing copy of the Microsoft sign-in page. Once you enter your password, the attacker uses it, and in more advanced kits also captures your MFA session. Microsoft does not send emails asking you to click a link to keep your password.

Example 2: The supplier’s new bank details

“Please note we have changed banks. Our new account details are attached. Please update your records before paying this month’s invoice.”

This is business email compromise. Sometimes it comes from a lookalike domain, and sometimes from your supplier’s real account after it has been hacked, which makes it very convincing. The fix is simple: always call the supplier on a number you already have before changing any payment details.

Example 3: The shared document

“Sarah has shared ‘Quote_Final_2026.pdf’ with you. Click to view.”

Attackers abuse the look of OneDrive, SharePoint and Dropbox sharing notices. If you were not expecting a document, check with the sender through a different channel before opening it.

Example 4: The government or courier impersonation

“You have a tax refund waiting” or “Your parcel could not be delivered, pay the redelivery fee.”

Scammers regularly pretend to be government agencies, banks, toll road operators and couriers. Go directly to the official website or app rather than following the link.

Example 5: The boss in a hurry

“Are you at your desk? I need you to do something quickly and quietly. I’m in a meeting so can’t talk.”

This usually leads to a request for gift cards or an urgent payment. The “can’t talk” line is deliberate, because a quick phone call would expose the scam.

Example 6: The QR code

“Scan this code to complete your multi-factor authentication setup.”

QR code phishing moves the attack to your phone, where it is harder to check the link and where email filters cannot follow. Treat unexpected QR codes in emails with the same suspicion as links.

What to do if someone clicks

Mistakes happen, even to careful people. What matters is acting quickly. Make sure your team knows that reporting a click straight away is the right thing to do, and that nobody will be blamed for it.

1. Disconnect from the network if an attachment was opened or something was downloaded.
2. Change the password from a different, trusted device if a password was entered on a suspicious page, and sign out of all sessions.
3. Tell your IT provider straight away, including when it happened and what was clicked.
4. Call your bank immediately if a payment may have gone to a scammer.
5. Report it. The Australian Cyber Security Centre explains how to report phishing through ReportCyber and Scamwatch on its phishing guidance page.

For a fuller checklist, read our guide on what to do in the first hour of a cyber attack.

How to reduce phishing risk across your business

Training helps, but you should not rely on people alone. Good technical controls catch most phishing before it reaches anyone, and limit the damage when something gets through.

• Multi-factor authentication on every account. A stolen password is far less useful when MFA is on. See our small business guide to MFA.
• Phishing-resistant sign-in. Passkeys and security keys cannot be typed into a fake website, which stops many credential theft attacks.
• Advanced email filtering. Tools such as Microsoft Defender for Office 365 check links at the moment they are clicked and open attachments safely first.
• Email authentication. SPF, DKIM and DMARC records make it harder for criminals to send email pretending to be your domain.
• A payment verification rule. Any change to bank details is confirmed by phone, using a known number, with no exceptions.
• Regular, short awareness training that uses realistic examples like the ones above.

Attackers also use methods beyond email. Our article on unexpected ways hackers get into business accounts covers several of them.

Frequently asked questions

What is the most common type of phishing email for small businesses?

Fake login notices, such as Microsoft 365 password or mailbox warnings, and invoice or payment scams are among the most common. Both aim to steal credentials or redirect money.

Can a phishing email come from someone I know?

Yes. If a supplier, client or colleague’s email account is compromised, attackers can send phishing emails from the real address. This is why unusual requests, especially about money, should always be verified by phone.

Is it safe to open a phishing email if I do not click anything?

Simply opening an email in a modern, up-to-date email app is generally low risk. The danger comes from clicking links, opening attachments, scanning QR codes or replying. If in doubt, report it to your IT provider and delete it.