How to spot phishing and protect against it

Phishing is a fraudulent e-mail pretending to come from a bank, supplier, colleague or well-known service. The goal is to steal a password, get a payment or run malicious software. Today's phishing e-mails are often free of spelling mistakes and target a specific company and person – so it pays to know the warning signs.

Warning signs

1. The sender

• The display name does not match the address – “John Smith, CEO” <john.smith.company@gmail.com>.
• The domain only resembles the real one – cornpany.com instead of company.com, rn instead of m, a different ending (company-com.net), an added word (company-invoices.com).
• Replies go elsewhere – the Reply-To address differs from the sender.

2. Content and tone

• Urgency and pressure – “within 24 hours”, “your account will be blocked”, “the CEO needs it now”.
• A request for secrecy – “do not tell anyone, this is a confidential acquisition”.
• Changed payment details – a supplier suddenly “changed their bank account”. This is the most expensive type of fraud (so-called BEC).
• An unexpected message – an invoice for something you did not order, a parcel you are not expecting, a shared document from a stranger.

3. Links

• Before clicking, hover over the link (on mobile, press and hold) and check the real address.
• Beware of link shorteners and addresses where the familiar name is only at the start: bank.com.account-check.example belongs to account-check.example.
• A QR code in an e-mail asking you to log in is a common trick to bypass link scanning.
• A login page that looks like Microsoft 365 or your bank but has the wrong address is fraud – whatever it looks like.

4. Attachments

• Risky ones are HTML files (often a fake login page), password-protected archives (the anti-virus cannot see inside), .iso, .img, .exe and .js files.
• A document asking you to “enable editing” or “enable content” is trying to run a macro.

What to do with a suspicious e-mail

1. Do not click or reply.
2. Verify through another channel – call the colleague or supplier on a number you already know, not the one in the e-mail.
3. Report it to IT so they can warn others and block the sender.
4. Then delete it.

When someone has already clicked

• Entered a password: change it immediately (and everywhere it was reused), sign out all active sessions and check the mailbox for new forwarding or deletion rules – attackers add them to stay unnoticed.
• Opened an attachment: disconnect the computer from the network and contact IT.
• Sent a payment: call your bank immediately – the sooner, the better the chance of stopping it – and report it to the police.
• Report the incident even if nothing seems to have happened. A fast response is what counts.

How to defend your company

• Mail filtering – anti-spam and anti-virus catch most fraud before anyone sees it. How Čistý mail works.
• DMARC on your own domain – attackers then cannot send e-mail directly with your address (guide).
• Multi-factor authentication – a stolen password alone is not enough.
• A payment rule – always verify a supplier's bank account change by phone; payments above a set amount need two approvers.
• Regular reminders for employees – a short example of current scams now and then does more than a one-off training.