Is this email a scam? The 60-second check

Most successful attacks on small businesses start with one email and one click. The good news is that most scam emails fall apart under a minute of scrutiny. Here is the 60-second routine we teach our clients' teams.

1. Check the actual sender address, not the display name

The display name can say anything. Tap or hover on it to reveal the real address. "Microsoft Support" sending from a random Gmail address, or your supplier's name spelled with one letter changed, is a scam. On a phone this is the step people skip, and it is the most important one.

2. Ask: was I expecting this?

An invoice you were not expecting, a delivery for something you did not order, a voicemail notification when your phone system does not email voicemails. Unexpected is not proof of a scam, but it earns the email the rest of this checklist.

3. Look for pressure

Urgency is the scammer's main tool: your account will be closed today, the director needs gift cards in the next hour, this invoice is overdue and legal action follows. Legitimate organisations almost never demand action within hours by email.

4. Check the link before you click

Hover over any link (or long-press on a phone) and read the address that appears. If the email says Microsoft but the link goes somewhere you have never heard of, stop. When in doubt, do not click the link at all. Go to the website yourself by typing the address you already know.

5. Money or credentials? Verify by another channel

Any email that asks you to pay, change bank details, or enter a password deserves a phone call to a number you already have on file. Not the number in the email. This one habit defeats invoice fraud, which costs Australian businesses more than almost any other scam.

What to do if you clicked

• Do not enter anything further, close the page.
• If you typed a password, change that password now, from a different device if possible.
• Turn on multi-factor authentication if it is not already on.
• Tell whoever looks after your IT immediately. Fast reporting is the difference between a near miss and a breach.

If your team would benefit from email filtering that catches these before they land, and security that holds up when someone does click, that is exactly what our managed security service does. Book a free IT review and we will show you where you stand.