How to spot a phishing email before it costs you

September 20, 2026 · 4 min read

That "your account has been suspended" email? Stop before you click. Phishing emails are designed to create panic so you act before you think — and one careless click can hand over your accounts, your data, or your business's finances.

Why phishing still works

Phishing isn't going away because it doesn't need to be clever. It needs to be fast enough that you react before you check. A fake "payment failed", a fake "invoice attached", a fake "your account has been suspended" — all built to trigger a reflex click rather than a considered one. The attacker doesn't need to fool everyone, just one tired employee on a Monday morning.

Five checks before you click any "urgent" link

• Hover over the sender's address. Does the domain actually match the company? accounts-verify-secure.com is not your bank.
• Look for spelling and grammar mistakes, and generic greetings like "Dear Customer" instead of your actual name.
• Never enter a password or card details from a link in an email. Open the site directly in your browser instead, the way you normally would.
• Check the urgency itself. Real companies rarely threaten to suspend your account within the hour. That pressure is the tell.
• When in doubt, verify through an official channel — the company's real website or a phone number you already had, not one from the email.

If you've already clicked

It happens to careful people too — don't waste time on embarrassment, just move fast:

• Change the password for that account immediately, and for any other account reusing it.
• Turn on multi-factor authentication if it isn't already on.
• Run a full scan with your antivirus/endpoint protection.
• If card or banking details were entered, call your bank straight away.
• Tell your IT provider or team — the sooner a compromised account is flagged, the smaller the blast radius.

How Computer Geeks helps with this

Our Cyber Secure monitoring includes email security filtering that catches a large share of phishing attempts before they land in an inbox at all, plus 24/7 alerting if an account does show signs of compromise. For most small teams, the biggest gap isn't technology — it's that nobody's ever walked staff through what a real phishing attempt looks like. We do that too.