How to spot a phishing email

Why this matters to you

More than 90% of successful breaches at small companies start with one employee clicking one link — not with a genius hacker, but with an email that looked normal.

Sign #1 — artificial urgency

“Within 24 hours”, “immediately”, “final warning”. The scammer’s goal is to make you act faster than you think. Real institutions never demand action “right now or lose everything”.

Sign #2 — the sender address

The display name can say “Microsoft” while the address is info@microsoft-security.xyz. Always check the actual email address, not the display name.

Sign #3 — links

Hover over a link without clicking to see the real address. microsoft-login.helpdesk-lt.com is not Microsoft. On a phone, long-press the link for a preview.

Sign #4 — the unexpected attachment

An invoice you didn’t expect. A “scanned document” from an unknown scanner. A ZIP called “CV”. If you weren’t expecting it, don’t open it until you’ve verified with the sender through another channel.

Sign #5 — the “boss” request

CEO fraud: an email supposedly from your manager urgently asking you to transfer money or buy gift cards. Always verify by phone on a known number. No real boss will be angry about a check — they will be angry about lost money.

When everything is genuine and the money still disappears

So far we have looked for signs: odd addresses, urgency, fake links. Here is a case from one of our clients where none of those signs were present.

An accountant received an invoice from an Italian supplier for services that had genuinely been delivered. The company had worked with that supplier for years. The email added one line: due to problems at the bank, please pay to a different account number. The transfer went out. A month later the supplier asked why the invoice was still unpaid.

Attackers had access to the supplier’s mailbox. They intercepted genuine emails and changed a single field in the document — the IBAN.

Why nothing we taught would have caught it

Check that email against everything so far:

• Sender address — genuine. Not similar; the same one.
• Mailbox and thread — genuine.
• Invoice — genuine, for work actually done.
• Relationship — years old, not a first payment.
• Language — clean, no urgency, no threats.

One thing changed: the account number.

This is called BEC (business email compromise), and it is the most expensive type of fraud for small companies — not because it is clever, but because there is nothing to spot.

The only rule that works

The account number changed → call. On a number you already knew. Not the one in the email.

Thirty seconds on the phone before any IBAN change. Always — even with a supplier of ten years, precisely because that is when nobody gets suspicious.

For managers, three things are worth putting in place:

1. IBAN changes as a separate procedure requiring a second approval.
2. A supplier bank-details list, checked before payment.
3. MFA on every mailbox — yours, and required of your partners.

Not just email — SMS too

A real message received in August 2026. Read it and look for three things:

1. 1 A Moroccan number (+212). A Lithuanian parking company does not text from Africa.
2. 2 Fake domain. The real one is unipark.lt. This is lwbtmfo.club — the "/com" at the end is there to fool your eye.
3. 3 The clever part. iPhones disable links from unknown senders. The scammer is asking you to switch off your own phone's protection. No real company ever sends that sentence.

When the fake looks perfect

This one landed in our own mailbox — at a glance, a tidy “Paysera” AML/KYC notice:

1. 1 The letters aren't letters. The subject is written in Greek and Cyrillic lookalikes. Filters see gibberish; you see "AML".
2. 2 Address doesn't match the name. "Paysera Check" writing from gmmobil.com.
3. 3 Invented legal authority. That contract clause doesn't exist — but it sounds serious.
4. 4 Link text ≠ destination. It displays paysera.com but travels through a Google redirect.
5. 5 And here they slipped: __PROT0__ — an unfilled template variable. Automation always leaks somewhere. Read the small print.

What that message cost

The same Unipark scheme, a real case. A company owner clicked the link, approved a Smart-ID prompt, saw a screen saying everything was fine — and later noticed a five-figure sum gone from the company current account.

He never typed a password for the attackers. He simply approved.

A Smart-ID approval is a signature

This is the most important point in the lesson.

The Smart-ID screen always states what you are approving and shows a verification code. The scam page connects to your bank at the same moment, so a genuine bank request appears on your phone. You are thinking about a parking fee while signing a banking operation.

Four rules:

1. Read what you are approving — not “approve”, but what.
2. The code on your phone must match the one shown on the page.
3. Expected one thing, asked for another (waiting for a parking fee, prompted for a bank login) → stop. Not later — that second.
4. Reach your bank only via its own app or by typing the address. Never from an SMS.

Incidentally, why the daily and monthly transfer limits did not stop it, the story does not say. So take the opportunity: check your own limits today. For most people they are set far higher than they ever need.

What to do with a suspicious email

1. Don’t click links or open attachments.
2. Report it to your IT team — or to us: pagalba@itbroliai.lt (forward it as an attachment so the headers survive). Urgent? Call +370 618 05093.
3. Delete it.
4. Already clicked? Tell IT, but you don’t need to change your password yet — clicking a link alone does not reveal it. Change your password only if you actually typed it into the fake page — whether or not the login appeared to work. Then change it immediately everywhere you reused it, and turn on MFA.

Reporting is never embarrassing. Staying quiet is.

Check yourself

Three questions — answer correctly and you’ll earn a certificate you can add to your LinkedIn profile.