How to Recognize and Respond to Phishing

Recognize suspicious requests, verify them through a trusted channel, and report concerns quickly without blame.

What phishing tries to make you do

Phishing messages impersonate a trusted person or organization to obtain information, money, account access or a downloaded file. They can arrive through email, text messages, chat or other channels.

The important question is what the message asks you to do. A sudden payment change, request for a sign-in code or unexpected document-sharing link deserves verification, even when the name and writing look familiar.

Warning signs are clues, not proof

Pressure to act quickly, unusual sender addresses, unexpected attachments and mismatched links are useful warning signs. Spelling mistakes can also be a clue, but polished writing and your correct name do not prove that a message is safe.

A familiar sender can be impersonated or have a compromised account. A legitimate service may also send an urgent notice. Instead of making a decision from one clue, verify the requested action independently.

Where your device supports it, inspect a link destination without opening it. Avoid treating the padlock or HTTPS as proof of who operates a site. When uncertain, open the service through a saved bookmark or known app.

Verify payments and account requests

For a change to bank details, an unusual transfer or a sensitive document request, use an established contact method. Call the number already in your records rather than a number supplied in the message. Follow the business's approval process before changing payment instructions.

Never share a sign-in password or one-time verification code in response to an unsolicited request. Do not approve an unexpected MFA prompt. If a message says an account needs attention, check through the known service or your IT contact.

If you clicked, report what happened

Stop interacting with the message or page and notify your IT contact promptly. Explain whether you only opened a page, downloaded or ran a file, entered credentials, approved a sign-in, or sent money. The response depends on what occurred.

A click alone does not prove that an account or device was compromised. Do not keep testing the link, and do not delete evidence while the incident is being assessed. Follow your organization's containment instructions.

If you entered credentials or sent money

If you disclosed a password, use a trusted device and the genuine service to change it. Alert the administrator so account sessions, access and suspicious activity can be reviewed. Change reused credentials where applicable.

If a payment was sent, promptly contact the bank through its established fraud channel and notify the person responsible for the business's incident process. Record what happened and follow the resulting instructions; recovery cannot be guaranteed.

Build a simple reporting habit

Show staff the approved reporting route and make it safe to report uncertainty or a mistake. Use the email application's reporting control where configured, together with your internal escalation process.

Combine reporting and verification habits with appropriately configured email protection, account controls and MFA. No single check prevents every attack. Guerrero Consulting can help review the controls and define a practical training and response scope.

References

Technical references reviewed October 21, 2026. Product features and licensing can change.

• Microsoft guidance on phishing

Back to all articles