How to Spot a Phishing Email: Warning Signs and Real Examples

Phishing emails try to trick you into clicking a link, opening an attachment, or handing over a password, an OTP, or money, by pretending to be your bank, a supplier, SARS, or someone inside your own business. You can catch most of them in under a minute by checking the sender address, the link, and whether the message is pushing you to act urgently.

Short answer

• Check the sender's actual email address, not just the display name.
• Hover over links before clicking to see where they really go.
• Be suspicious of urgency, threats, or offers that feel too good to be true.
• Never share a password or OTP by email, SMS, or phone, even if the caller says they're from your bank.
• Verify unusual payment or banking-detail requests through a phone number you already have, not one in the email.
• If you're not sure, report it and don't click anything.

What a phishing email is trying to do

Phishing is a form of social engineering: the email impersonates a trusted sender to get you to act without checking. Verizon's 2026 Data Breach Investigations Report found phishing was the initial access point in 16% of all data breaches worldwide, and 9% of breaches at small and medium businesses, with credential abuse (stolen passwords) involved in a further 13%. In South Africa, SABRIC's 2025 crime statistics put digital banking crime losses at R2.41 billion for the year, driven mainly by social engineering and customer compromise rather than technical hacking. The attacker usually doesn't need to break into anything. They just need one person to click.

The warning signs to check

A handful of checks catch most phishing emails, even well-written ones.

The sender address, not just the name. Email clients show a display name, but the real address can be completely different. "SARS eFiling" can sit on top of an address that has nothing to do with sars.gov.za. Click or tap the sender's name to see the full address.

Lookalike or shortened links. Criminals buy domains that look almost right, such as swapping one letter, adding a word, or using a different ending (.com instead of .co.za). Hover over a link on a computer, or press and hold it on a phone, to see the real destination before you tap it. Treat shortened links (bit.ly and similar) in an unexpected email with extra caution, since they hide the real address.

Urgency, threats, or rewards. "Your account will be suspended," "action required within 24 hours," or "you've won" are all designed to make you act before you think. CISA's guidance on recognising phishing lists this kind of pressure as one of the clearest red flags, alongside requests for personal or financial information.

Requests for passwords, OTPs, or payment details. No legitimate bank, supplier, or email provider will ever ask you to reply with a password or one-time PIN. SABRIC is explicit on this: never share an OTP with anyone, including someone who says they're calling from your bank.

Unexpected attachments. An invoice, delivery notice, or "signed document" you weren't expecting is a common way to deliver malware. If you weren't expecting it, confirm with the sender through a separate channel before opening it.

Good grammar is no longer proof it's genuine. CISA also flags that AI tools now let scammers write polished, error-free emails, so don't rely on spelling mistakes as your main test.

Real examples South African businesses see

Four patterns show up again and again in local inboxes:

The fake SARS or bank notice. "Your tax refund is ready" or "unusual activity on your account," with a link to a login page that captures your username and password. The real SARS and your bank will never ask you to confirm your login details by email.

The OTP or account-takeover call. You get an SMS with an OTP you didn't request, followed by a call from someone claiming to be your bank asking you to read it back "to verify your identity." Reading it back hands over the one thing protecting your account.

The fake invoice or banking-detail change. An email that looks like it's from a real supplier, asking you to pay an invoice to "updated" banking details, or an email that looks like it's from your own boss, asking finance to make an urgent payment. This is business email compromise, and it is one of the most expensive forms of phishing because there's no malware for your antivirus to catch, just a convincing email.

The fake Microsoft 365 or Google warning. "Your mailbox is full" or "unusual sign-in detected," linking to a fake login page built to steal your work email password. Once an attacker has that password, they can see everything in your inbox and send further phishing emails from your real address, which is exactly how business email compromise usually starts.

How to check a link or sender before you click

1. Hover over the link (or press and hold on mobile) and read the full address, starting from the https:// and working to the first single slash.
2. Check that the domain matches the real company exactly. "mammothdigital-support.com" is not the same as mammothdigital.co.za.
3. Open the sender's full email address, not just the display name, and check the part after the @.
4. If anything about a payment, password, or urgent request feels off, phone the person or company using a number you already have, not one from the email.
5. When in doubt, don't click, and report the message instead.

What to do if you clicked

• Change the password for that account immediately, and for any other account using the same password.
• Turn on multi-factor authentication if it isn't already on, so a stolen password alone isn't enough.
• If you entered banking details or an OTP, contact your bank immediately. SABRIC's advice is to act as soon as you realise, not wait to see if anything happens.
• Tell whoever manages your IT or website, in case the same email went to colleagues or the attacker is now inside a shared mailbox.
• If customer or employee personal information may have been exposed, South Africa's POPIA requires you to notify the Information Regulator, and usually the affected people, as soon as reasonably possible after you discover it.
• If your website itself has been compromised rather than just a mailbox, see our guide on what to do if your website is hacked.

Reporting a phishing email

Most mailboxes have a built-in way to report phishing rather than just deleting it, which helps your spam filters learn and can protect colleagues who received the same email. In Gmail, open the message, click the More menu next to Reply, and choose "Report phishing." In Microsoft 365 and Outlook, look for the "Report" button in the ribbon. Reporting takes a few seconds and is more useful than simply deleting the message.

Checklist: spot a phishing email in under a minute

Get help securing your business email

A handful of settings, such as email authentication and spam filtering, catch a large share of phishing emails before they ever reach an inbox. If you want your business email and website properly protected, our Security & Networking team can review what you have in place, and Cloudflare's email security tools can be set up alongside your existing mailbox. Get in touch and we'll reply within 2 working days.

Facts checked on 9 November 2026. Sources: CISA: Recognize and Report Phishing (opens in a new window), Google: Avoid and report phishing emails (opens in a new window), Verizon 2026 Data Breach Investigations Report, Executive Summary (opens in a new window), SABRIC: How to Stay Safe (opens in a new window), SABRIC Annual Crime Statistics Report 2025 (opens in a new window), POPIA section 22: Notification of security compromises (opens in a new window).