The signs of phishing are pressure, requests for private or financial details, links you cannot verify, and addresses that are slightly wrong. If a message has them, do not click, report it, and delete it. If it might be real, contact the sender through a method you already know.
The warning signs
CISA lists these:
- Pressure tactics: urgency, strong emotion, threats of serious harm if you do not act now.
- Requests for private details or financial information.
- Shortened links you cannot check.
- Email addresses or links with a small error, such as a swapped letter in a brand name.
CISA also notes that good grammar no longer clears a message, because AI can produce flawless text. Old advice about spotting typos is out of date.
What to do
- Do not click links or open attachments.
- Report it using the report option in your mail app, or the report spam button.
- Delete it. Do not reply and do not click unsubscribe.
- If it might be real, do not use the links or phone numbers in it. Type the company's address yourself or call a number you already have.
Print that list. Put it where staff and volunteers will see it.
Where phishing hits small organizations hardest
Payment changes. A message that looks like it comes from the director asking the finance volunteer to change a bank detail or buy gift cards is a classic. Make a rule: any change to payment details is confirmed by phone with a known number.
Shared accounts. A password sent to a volunteer by email is an invitation. Use a password manager's sharing feature or a proper shared mailbox.
Account lockout messages. "Your mailbox is full, click to keep it" is a common trick. Real mail systems do not need you to log in through an email link.
Make reporting safe
People hide mistakes when they fear blame. Say in writing that clicking a bad link is common and that reporting it fast is what you want. A teacher who reports a click within minutes is doing the right thing.
When someone reports a click, change the password, check for forwarding rules on the mailbox, and review recent sign-ins.
Add technical backstops
Training is not enough on its own. Turn on multi-factor authentication, flag external email, and set up SPF, DKIM and DMARC for your domain so scammers cannot easily spoof it. CISA's ransomware guidance lists DMARC and external email flagging among its phishing defenses.
Quick check
Is perfect grammar a sign an email is safe?
No. CISA says polished grammar does not rule out phishing, since AI can write flawless messages.
Sources
Last reviewed: 19 October 2026.
