# How to spot a phishing email > In 10 minutes, learn to recognise scam emails by the 5 signs real attackers use. ## Why this matters to you More than 90% of successful breaches at small companies start with one employee clicking one link — not with a genius hacker, but with an email that looked normal. ## Sign #1 — artificial urgency "Within 24 hours", "immediately", "final warning". The scammer's goal is to make you act faster than you think. Real institutions never demand action "right now or lose everything". ## Sign #2 — the sender address The display name can say "Microsoft" while the address is `info@microsoft-security.xyz`. Always check the actual email address, not the display name. ## Sign #3 — links Hover over a link **without clicking** to see the real address. `microsoft-login.helpdesk-lt.com` is not Microsoft. On a phone, long-press the link for a preview. ## Sign #4 — the unexpected attachment An invoice you didn't expect. A "scanned document" from an unknown scanner. A ZIP called "CV". If you weren't expecting it, don't open it until you've verified with the sender through another channel. ## Sign #5 — the "boss" request CEO fraud: an email supposedly from your manager urgently asking you to transfer money or buy gift cards. Always verify by phone on a known number. No real boss will be angry about a check — they will be angry about lost money. ## When everything is genuine and the money still disappears So far we have looked for signs: odd addresses, urgency, fake links. Here is a case from one of our clients where **none of those signs were present**. An accountant received an invoice from an Italian supplier for services that had genuinely been delivered. The company had worked with that supplier for years. The email added one line: due to problems at the bank, please pay to a different account number. The transfer went out. A month later the supplier asked why the invoice was still unpaid. Attackers had access to the **supplier's** mailbox. They intercepted genuine emails and changed a single field in the document — the IBAN. ## Why nothing we taught would have caught it Check that email against everything so far: - Sender address — **genuine**. Not similar; the same one. - Mailbox and thread — **genuine**. - Invoice — **genuine**, for work actually done. - Relationship — **years old**, not a first payment. - Language — **clean**, no urgency, no threats. One thing changed: the **account number**. This is called BEC (business email compromise), and it is the most expensive type of fraud for small companies — not because it is clever, but because there is nothing to spot. ## The only rule that works > **The account number changed → call.** > On a number you already knew. Not the one in the email. Thirty seconds on the phone before any IBAN change. Always — even with a supplier of ten years, precisely because that is when nobody gets suspicious. For managers, three things are worth putting in place: 1. IBAN changes as a separate procedure requiring a second approval. 2. A supplier bank-details list, checked before payment. 3. MFA on every mailbox — yours, and required of your partners. ## Not just email — SMS too A real message received in August 2026. Read it and look for three things:
← +212 7 74 08 63 05 1
Unipark – Notice of unpaid parking fee According to our system, a parking fee linked to your vehicle has not been received. To avoid additional charges and possible administrative restrictions, please make the payment as soon as possible. To review your parking session details, visit our official website and enter your vehicle registration number. https://unipark.lwbtmfo.club/com 2 (Simply reply "T", then close the SMS and open it again to activate the link. 3 If the link still does not work, copy it into the Safari browser.) To avoid further administrative proceedings, we kindly ask you to pay promptly. Customer Service Department
A real scam message (translated; the original was in Lithuanian).
  1. 1 A Moroccan number (+212). A Lithuanian parking company does not text from Africa.
  2. 2 Fake domain. The real one is unipark.lt. This is lwbtmfo.club — the "/com" at the end is there to fool your eye.
  3. 3 The clever part. iPhones disable links from unknown senders. The scammer is asking you to switch off your own phone's protection. No real company ever sends that sentence.
## When the fake looks perfect This one landed in our own mailbox — at a glance, a tidy "Paysera" AML/KYC notice:
Outlook2026-08-04 09:12
ΑΜL/ΚΥС геquігеmеntѕ – confігm уоuг іdеntіtу 1
Ρ Ρауѕега Сһесk
siska@gmmobil.com 2
To: antanas@itbroliai.lt
Dear customer, under money laundering prevention requirements we must re-confirm your identity. Under clause 2.13 of your agreement 3, failure to confirm within 10 working days may result in restricted services. Confirm identity: һttрѕ://www.рауѕега.соm/en/confirm 4 Request no.: KEB-147-__PROT0__ 5 Paysera LT, Pilaitės pr. 16, Vilnius · +370 5 2071 558
🖱 Hovering reveals the real link:
google.com/share.google?q=7PZFAudJ2yA73JkEn
Five techniques stacked in one email.
  1. 1 The letters aren't letters. The subject is written in Greek and Cyrillic lookalikes. Filters see gibberish; you see "AML".
  2. 2 Address doesn't match the name. "Paysera Check" writing from gmmobil.com.
  3. 3 Invented legal authority. That contract clause doesn't exist — but it sounds serious.
  4. 4 Link text ≠ destination. It displays paysera.com but travels through a Google redirect.
  5. 5 And here they slipped: __PROT0__ — an unfilled template variable. Automation always leaks somewhere. Read the small print.
## What that message cost The same Unipark scheme, a real case. A company owner clicked the link, **approved a Smart-ID prompt**, saw a screen saying everything was fine — and later noticed a **five-figure sum** gone from the company current account. He never typed a password for the attackers. He simply approved. ## A Smart-ID approval is a signature This is the most important point in the lesson. The Smart-ID screen always states **what** you are approving and shows a verification code. The scam page connects to your bank at the same moment, so a genuine bank request appears on your phone. You are thinking about a parking fee while signing a banking operation. Four rules: 1. **Read what you are approving** — not "approve", but *what*. 2. **The code on your phone must match** the one shown on the page. 3. **Expected one thing, asked for another** (waiting for a parking fee, prompted for a bank login) → stop. Not later — that second. 4. **Reach your bank only via its own app** or by typing the address. Never from an SMS. Incidentally, why the daily and monthly transfer limits did not stop it, the story does not say. So take the opportunity: **check your own limits today.** For most people they are set far higher than they ever need. ## What to do with a suspicious email 1. Don't click links or open attachments. 2. Report it to your IT team — or to us: **pagalba@itbroliai.lt** (forward it as an attachment so the headers survive). Urgent? Call **+370 618 05093**. 3. Delete it. 4. **Already clicked?** Tell IT, but you don't need to change your password yet — clicking a link alone does not reveal it. **Change your password only if you actually typed it** into the fake page — whether or not the login appeared to work. Then change it immediately everywhere you reused it, and turn on MFA. Reporting is never embarrassing. Staying quiet is. ## Check yourself Three questions — answer correctly and you'll earn a certificate you can add to your LinkedIn profile.