<\/span><\/h2>\nBelow are the key elements to evaluate before<\/strong> clicking on links, opening attachments, or replying.<\/p>\n\n\n\n| #<\/th>\n | Checkpoint<\/th>\n | What to ask \/ look for<\/th>\n | Why it matters<\/th>\n<\/tr>\n<\/thead>\n |
\n\n| 1<\/td>\n | Sender & \u201cFrom\u201d address<\/strong><\/td>\n| \u2022 Does the sender\u2019s email domain match what you expect (e.g.,\u202f@yourcompany.com, @your\u2011bank.com)? \u2022 Is the display name masking a different domain (e.g., \u201cBank Support\u201d but @gmail.com or misspelt domain)? \u2022 Is it the first time you\u2019ve received mail from this sender? (Microsoft Support<\/a>)<\/td>\n | Attackers often spoof or hijack display names, but the full email address still reveals anomalies.<\/td>\n<\/tr>\n | \n| 2<\/td>\n | Misspelt \/ altered domains<\/strong><\/td>\n| \u2022 Is the domain slightly misspelt (e.g., amaz0n.com vs amazon.com)? \u2022 Are there added words\/numbers to the domain (e.g., bank\u2011login.com instead of bank.com)? (itgovernance.co.uk<\/a>)<\/td>\n | Subtle domain modifications are a frequent trick to deceive recipients.<\/td>\n<\/tr>\n | \n| 3<\/td>\n | Urgent language \/ pressure<\/strong><\/td>\n| \u2022 Does the email demand immediate action (\u201cAct now!\u201d, \u201cLast chance\u201d, \u201cYour account will be closed\u201d) \u2022 Does it threaten negative outcomes if you don\u2019t act quickly? (bitlyft.com<\/a>)<\/td>\n | Urgency is used to push recipients into acting before they scrutinise the message.<\/td>\n<\/tr>\n | \n| 4<\/td>\n | Unexpected links or attachments<\/strong><\/td>\n| \u2022 Are there links where the displayed text doesn\u2019t match the destination when you hover over it? \u2022 Is there an unexpected attachment (especially .zip, .exe, .scr, or unknown extension) you didn\u2019t ask for? (Cofense<\/a>)<\/td>\n | Malicious links\/attachments are the main vector for malware, credential theft and phishing.<\/td>\n<\/tr>\n | \n| 5<\/td>\n | Requests for credentials \/ sensitive info<\/strong><\/td>\n| \u2022 Is the email asking you to provide username\/password, payment info, or confirm personal data via email or link? \u2022 Is it saying \u201cWe\u2019ll reset your password if you click here\u201d? (OCC.gov<\/a>)<\/td>\n | Legitimate organisations rarely ask for credentials via email; this is a common phishing indicator.<\/td>\n<\/tr>\n | \n| 6<\/td>\n | Generic greetings \/ tone out of place<\/strong><\/td>\n| \u2022 Does it say \u201cDear Customer\u201d rather than using your name? \u2022 Is the style\/tone inconsistent with what you normally receive from the sender? (Cofense<\/a>)<\/td>\n | A message that feels \u201coff\u201d in tone or personalization is a sign of impersonation or mass\u2011mailing.<\/td>\n<\/tr>\n | \n| 7<\/td>\n | Spelling, grammar or style errors<\/strong><\/td>\n| \u2022 Are there obvious mistakes, awkward phrasing or low\u2011quality layout\/images? \u2022 Is the message poorly formatted compared with official communications? (Cofense<\/a>)<\/td>\n | Professional organisations normally proof\u2011read emails; errors often signal a scam.<\/td>\n<\/tr>\n | \n| 8<\/td>\n | Too good to be true \/ unsolicited offers<\/strong><\/td>\n| \u2022 Did you receive an email about winning a prize or getting large returns you didn\u2019t expect? \u2022 Did you not initiate any contact but are being asked for something? (Ohio University<\/a>)<\/td>\n | Offers that arrive out of the blue and seem unrealistic are typical scam patterns.<\/td>\n<\/tr>\n | \n| 9<\/td>\n | Mismatched \u201cFrom\u201d vs \u201cReply\u2011to\u201d vs \u201cReturn\u2011Path\u201d<\/strong><\/td>\n| \u2022 Does the \u201creply\u2011to\u201d address differ from the \u201cfrom\u201d address? \u2022 Is the return\u2011path or header unusual (for tech\u2011savvy users) indicating redirection? (arXiv<\/a>)<\/td>\n | Email header anomalies often reveal deeper spoofing or redirection.<\/td>\n<\/tr>\n | \n| 10<\/td>\n | External sending \/ unexpected sender flag<\/strong><\/td>\n| \u2022 Is the sender marked \u201c[External]\u201d or flagged outside your organisation? \u2022 Is the sender someone you know but the context is odd\/unexpected? (Phishing Education & Training<\/a>)<\/td>\n | Recognising external emails or unexpected communication helps reduce internal trust\u2011based mistakes.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
\n | | | | | | | | | | |