Suspicious Email Checklist

The most useful phishing skill is not technical. It is the ability to pause when an email tries to make you hurry. Most bad messages need you to act before you check.

Stop before you click

Treat these as immediate pause signs. They do not prove the message is malicious, but they are enough reason to slow down and verify.

• §A sender address that does not match the organisation it claims to represent.
• §A generic greeting in a message that should know who you are.
• §Unexpected attachments, especially invoices, shared documents, or compressed files.
• §Pressure language: final notice, urgent action required, account closing, or payment overdue.
• §A link whose hover destination does not match the visible text or expected domain.
• §A request for passwords, MFA codes, bank details, payroll details, or gift cards.

Verify on a different channel

Do not reply to the suspicious email to ask whether it is real. If the mailbox is compromised, you are asking the attacker. Open a new browser tab and type the official address yourself, or call a known number from your records.

1. 01Check whether you expected the message.
2. 02Inspect the sender address, not only the display name.
3. 03Hover over links without clicking them.
4. 04Confirm payment or bank-detail changes by phone using a number you already trust.
5. 05Report the message through your mail client or internal process.

“A two-minute verification call is cheaper than a week of incident response.”

Common shapes

Banking and payment messages

A message says there is suspicious activity, a refund, or a payment problem. Go to the bank or payment provider directly. Do not use the email link.

Government and tax messages

ATO and myGov-themed messages are common because tax, refunds, and penalties create urgency. Use the official portal or app you already know.

Delivery and invoice messages

Fake delivery notices and altered invoices work because they blend into normal admin. Match the tracking number, supplier record, and payment details before acting.

If you clicked

Clicking a link is not the end of the story. The important question is what happened next.

• §If you only opened the page, close it and report the message.
• §If you entered a password, change that password immediately from the real site and sign out of other sessions.
• §If you entered payment details or approved a transfer, call the bank immediately.
• §If this happened on a work device or account, tell the person responsible for IT. Early reporting helps.