How to Recognize a Suspicious Email

A suspicious email is not always full of spelling mistakes.

Many phishing emails look clean, professional, and business-like. Some use real logos. Some copy real notification templates. Some may even appear inside an existing email thread after an account has been compromised.

The goal of email security awareness is not to make employees afraid of every message. The goal is to help them recognize when a message deserves verification before action.

Image: Type: Context. Mô tả: “A clean inbox screenshot concept with one highlighted suspicious email and callouts for sender, subject, link, attachment, and requested action.”. caption: “Suspicious email review should focus on signals, not guesswork.”

Context

Email remains one of the most common entry points for social engineering, credential theft, malware delivery, and business email compromise.

A suspicious email usually tries to create one of three outcomes:

  1. Make the user click a link.
  2. Make the user open an attachment.
  3. Make the user perform a business action.

The business action may be more dangerous than the link. For example, a fake invoice approval or bank account change request can create direct financial loss even without malware.

The Suspicious Email Checklist

Use this checklist before clicking, downloading, replying, or approving anything sensitive.

1. Check the Sender Carefully

Do not rely only on the display name.

A display name can say “IT Support” or “Finance Team” while the real email address belongs to an unrelated domain.

Look for:

  • Misspelled domains
  • Strange subdomains
  • Free email addresses used for business requests
  • Unexpected external senders
  • Display name mismatch
  • Recently changed sender behavior
  • Reply-to address different from the From address

Example signal:

Display name: Microsoft Support
Actual sender: security-update@example-random-domain.com

That mismatch should trigger verification.

2. Inspect the Request

Ask: what does this email want me to do?

Suspicious actions include:

  • Entering credentials
  • Approving MFA
  • Opening an attachment
  • Enabling macros
  • Downloading a file
  • Sharing sensitive information
  • Changing payment details
  • Buying gift cards
  • Moving to WhatsApp, Telegram, or personal email
  • Ignoring normal approval workflow

A message becomes high-risk when it asks for action that affects identity, money, data, or access.

3. Watch for Urgency and Pressure

Urgency is a classic social engineering trigger.

Be careful with messages that say:

  • “Immediate action required”
  • “Your account will be suspended”
  • “Payment deadline today”
  • “Final warning”
  • “Do not delay”
  • “Respond within 10 minutes”

Urgency does not prove an email is malicious. But it does mean verification matters more.

On desktop, hovering over a link can show the destination URL. On mobile, long-press preview behavior depends on the device and app, so be careful.

Look for:

  • Domains that do not match the expected service
  • URL shorteners
  • Lookalike domains
  • Strange path names
  • Unexpected login pages
  • HTTP instead of HTTPS
  • Misspelled brand names
  • Links to file-sharing pages you did not expect

Do not enter credentials into a page reached from a suspicious email. Open the official website directly from a bookmark or typed address instead.

Image: Type: Test case. Mô tả: “A training example showing a link where the visible text says a trusted brand, but the hover preview shows a different domain.”. caption: “The visible link text and the real destination may be different.”

5. Treat Attachments as High Risk

Attachments can be used to deliver malware, steal information, or lure users into entering credentials.

Be cautious with:

  • Unexpected invoices
  • Password-protected archives
  • Documents asking to enable macros
  • HTML attachments
  • Script files
  • Unknown file extensions
  • Attachments from external senders
  • Attachments that create urgency

A legitimate attachment should make sense in context. If it does not, verify first.

6. Review the Tone and Context

Some suspicious emails look technically clean but feel wrong.

Examples:

  • A colleague writes in an unusual style
  • A manager asks for secrecy
  • A vendor changes payment details suddenly
  • HR asks for personal documents through an unusual link
  • IT asks for your password
  • A cloud document appears unrelated to your work

Context is a security control. If the request does not fit the relationship, verify it.

7. Look for Business Process Violations

Many serious phishing incidents succeed because the target follows an email instruction instead of the official process.

Be cautious if the email asks you to bypass:

  • Purchase approval
  • Payment verification
  • Vendor onboarding
  • Identity verification
  • Password reset process
  • Security reporting
  • Legal review
  • Change management

A strong company does not rely on email alone for sensitive approvals.

What Not to Do

Do not:

  • Click just to “see what happens”
  • Reply to the suspicious sender for verification
  • Forward the email widely
  • Enter fake credentials into the page
  • Upload the attachment to random online tools
  • Ignore the email if you already clicked
  • Hide the mistake if you interacted with it

Early reporting reduces impact.

What to Do Instead

If you suspect phishing:

  1. Stop interacting with the message.
  2. Report it using the company phishing report button or security mailbox.
  3. Verify through a trusted channel if business action is required.
  4. If credentials were entered, change the password and report immediately.
  5. If MFA was approved unexpectedly, report immediately.
  6. If a file was opened, contact security immediately.

Quick Rule

If a message creates urgency, asks for credentials, changes money flow, requests sensitive data, or bypasses normal process, treat it as suspicious until verified.

References

CTA

KevinSec can help your team build a simple suspicious email checklist, reporting workflow, and safe awareness training program.

If your employees are unsure what to report, contact KevinSec to design a phishing awareness workflow that is easy to follow in real business environments.