How to identify phishing emails
It’s no surprise that the last 3 years have seen a surge in cybercrime, largely due to the COVID-19 pandemic, millions of workforces working remotely and healthcare data being the main target. Online crime has become a huge threat to organisations of all sizes across the globe, and phishing emails is one of the most common and dangerous methods that criminals use. Although it might have been easy to spot in the past, as criminals become more sophisticated, it is becoming more difficult to identify phishing emails.
Phishing motive
The idea behind these attempts is to secure personal or financial information from the victim, and hundreds of thousands of people fall victim to criminals every year. According to the Zscaler ThreatLabz 2025 Phishing Report, while overall phishing volume dropped 20% in 2024, the attacks have become far more targeted and leverage generative AI to outwit traditional filters.
The Anti‑Phishing Working Group reported over 1 million phishing attacks in Q1 2025, a surge that included a 33% rise in business email compromise-related wire‑transfer scams.
Meanwhile, Hoxhunt’s 2025 Trends Report highlights that phishing campaigns have ballooned, over 50 million simulations and live attacks were tracked, with a 4,151% overall increase in phishing volume since the launch of ChatGPT in 2022.
These findings demonstrate that despite fewer total attacks, phishing has grown deeper and more insidious, requiring a stronger focus on detection, training, and AI-aware defences.
Despite the rising sophistication of these attempts, there are still a number of ways to identify phishing emails.
How to identify phishing emails
Suspected Phishing Email? Check the sending address
One of the first ways to identify a phishing email is to check the email address that it has been sent from, not just the stated sender’s name. An immediate warning sign should be if it is coming from a public email domain, such as Gmail or Yahoo or a strange email address. Any legitimate company will likely contact you from a personalised domain name, and these are very easy to check by simply typing that domain into a search engine.
Scammers are able to adapt the appearance of the overall email, making it look as realistic as possible; however, the sending address is sometimes the giveaway. To get around this, many experienced criminals attempt to make it look believable at a quick glance, so make sure you check the address for any spelling mistakes or if it contains additional letters or numbers.
Take a look at the email pictured below (received this week by a colleague) – the sender address is unusual and the red padlock icon shows that TLS encryption was not used, which is also unusual. Both of these would immediately raise suspicions (click the image to make it larger).
Phishing emails can be poorly written
One of the clearest ways to determine if an email is a phishing attempt is to check the overall spelling, grammar, and look and feel. When a legitimate company contacts you, they are attempting to sell their brand and company to you, so they will ensure that the email is captivating and well-written. On the other hand, scammers do not have such concerns and are simply trying to send as many different emails to as many people as possible.
Although there is a common belief that scammers keep these mistakes on purpose in order to filter out the less gullible, the truth is that for many scammers, English is either not their first language or they may have had limited access to education. This means that they have run the email through spellcheck or a translation service, which often results in the messaging not quite conveying the right context.
Returning to the same email, you can see from the image below that the look and feel are odd. There is no sender name, brand, or logo; the email isn’t well personalised (instead, the first part of the recipient’s email address is used), and there is a clear call to action, which is the button inviting the recipient to click. Because the sender isn’t named and the content of the ‘package’ isn’t mentioned, the aim seems to be to get recipients to click the link to find out more.
But not always…
In fact some of the most recent phishing emails our team has encountered, have been scarily, legitimate-looking. The more sophisticated attacks nowadays, especially as we see the rise of AI written content in 2025, can be very convincing. Which means you need to be extra vigilant, and never click links until you’ve checked the sending email address.
One of our employees recently was the target of a recruitment phishing email scam. Seemingly from the well-known global brand, Red Bull, suggesting a good fit for a role at the company. One of our SOC analysts pulled the thread and uncovered a full scale, sophisticated attack:
The email came from what looked like a legitimate service:
messaging-service@post.xero[.]com
Not only that, but the message also passed SPF, DKIM, and DMARC, making it appear clean to most email filters.
Looking deeper into the headers, I found:
- Sender IP: 198.244.57.62 (Mailgun US)
- Authenticated domain: post.xero.com
- X-Mailgun headers: Confirmed it originated from a high-risk IP pool
- SCL (Spam Confidence Level): 1 Microsoft didn’t flag it as spam
Despite all signs pointing to legitimacy, the Reply-To address revealed the trick:
red.bull.crew@srbs.user0212-stripe[.]com
This technique, riding on the reputation of a legitimate sender, is increasingly common in modern phishing campaigns. Abuse of services like Mailgun, SendGrid, or Salesforce to deliver malicious content allows attackers to bypass basic spam detection.
Suspicious links or attachments in emails
Another common sign of a phishing email attempt is a message containing suspicious attachments. Usually, the email will not provide much information, encouraging the recipient to open the attachment, which will then lead to malware being installed on their device.
Suspicious links are also a clear sign of a phishing email attempt. Many scammers hide these links behind shortened links such as a bit.ly link or behind a clickable button, preventing suspicions from being aroused by the recipient when they see the link.
While these three might be the key factors to consider, they are not the only warning signs. Any time you receive mail that you were not expecting, practice caution before clicking or responding. Scammers like to create a sense of urgency or force you towards a link to find out more, and it only takes a momentary lapse in concentration for you to fall victim.
In our case, the email below uses a combination of these techniques. Little information is provided to encourage the recipient to click the link, and a sense of urgency has been created by stating delivery is waiting for shipment. Although you can’t see it, the addresses linked to by the button and unsubscribe links are hidden behind bit.ly links.
Scam mail: Don’t expect the unexpected
Our final tip is an important one because not all phishing emails are so obvious. They are becoming more sophisticated and created to look like genuine emails from HRMC, Amazon, Microsoft, and others. Be suspicious If you receive unexpected mail that that includes an attachment or link, especially if it is unexpected good news such as an HMRC refund email or a purchase order. Don’t open the attachment or follow the link.
If for any reason you do click a link in an unexpected email, never, in any circumstances, submit a username or password on a site it takes you to. Instead, call the sender (don’t email them as the attacker will be happy to email you back) or ask your IT or information security team to take a look. This shouldn’t slow you down and if the email wasn’t expected then a little delay won’t hurt. Sometimes they might be genuine – last week we received an unexpected purchase order; we ran it through malware scanners and contacted our customer separately to ask if it was genuine. It turned out it was, but we didn’t open it until we were sure.
Phishing awareness is key
Even though your employees might be trained annually on security, people forget things and make quick decisions when busy and under pressure. For this reason, it’s important to maintain ongoing awareness, such as employee phishing tests, ‘drip’ awareness campaigns with examples of phishing emails, and reminding people what to look for and what steps to take.
Phishing awareness training for your organisation
If you need help to improve security awareness and reduce the risks of phishing emails, please get in touch with our friendly team today.
Computer vector created by upklyak – www.freepik.com – edited by Evalian
