Is this email a scam? A 10-point checklist

Warning signs

1. The sender's address doesn't match. The name says your bank or Microsoft, but the actual email address is something else. Look at the address, not just the name.
2. It's urgent or threatening. "Your account will be closed today," "final notice," or "act now" are classic pressure tactics.
3. It asks you to sign in. Links that take you to a login page for Microsoft 365, your bank, or a shipping company are the most common trap.
4. It asks for money or gift cards. Especially a "boss" asking for gift cards or an urgent wire transfer.
5. Payment details changed. A vendor emails new bank details for an invoice. Always confirm by phone using a number you already have.
6. Unexpected attachments. Invoices, voicemails, or "documents" you weren't expecting, especially .zip, .html, or files that ask you to enable macros.
7. Links don't match. Hover over a link (don't click) and check where it really goes.
8. Generic greeting. "Dear customer" from a company that knows your name.
9. Odd spelling or formatting. Less common than it used to be, but still a warning sign.
10. It just feels off. Trust that instinct. Checking takes a minute; recovering from a breach can take weeks.

What to do

• Don't click, reply, or open attachments to "test" it.
• Verify another way. Call the person or company using a number you already have, not one in the email.
• Report and delete it. In Outlook, use Report → Report phishing.

Already clicked or entered a password?

Act quickly. Change that password from a different device, make sure multi-factor authentication is on, and call us at 951-595-7716. The sooner it's handled, the less damage it can do.

Want to know how well your business is protected against phishing? Take the free IT Gap Assessment in our Help Center. It checks MFA, email protection, backups, and staff training in about five minutes.