Phishing email red flags are the visible tells that separate a real message from a trap — and in 2026 the traps are good enough that checking for them has to be a habit, not an instinct. This guide lists the twelve signs worth checking on any email that asks you to click, pay, log in or reply, in the order a security analyst would check them.
TL;DR
- The sender's full address — not the display name — is the first and most reliable check; lookalike domains are the single most common tell.
- Urgency plus authority is the emotional signature of nearly every phishing email; real businesses rarely need a password in the next hour.
- Any change to bank details, any MFA code you did not request, and any unexpected attachment are automatic stops.
- Hover a link before clicking: the destination domain is written in plain sight.
- One person spotting a flag and reporting it protects every mailbox in the company — reporting takes under a minute.
Why checking flags still matters in 2026
Filters catch the bulk campaigns, but the attacks that cost money are the ones written to slip past them. The Australian Signals Directorate received more than 84,700 cybercrime reports in FY2024-25 — roughly one every six minutes — and email compromise, both with and without financial loss, was the top self-reported cybercrime category for businesses (ASD Annual Cyber Threat Report 2024-25). Roughly 60% of breaches involve a human element — a click, an error, a person talked into an action (Verizon, 2025 DBIR). The person reading the email is the control that gets tested.
The good news: phishing is industrial production, and industrial production leaves seams. Here are the twelve to look for.
The twelve red flags
1. The display name and the address do not match
"John Smith (CEO)" in bold means nothing — the display name is free text anyone can set. Expand or hover the sender line and read the actual address: john.smith@cyberaware.com.au versus john.smith@cyberaware-au.com. The second one is the scam.
2. A lookalike domain
Attackers register domains one character away from the real thing: rn for m, .co for .com.au, a hyphen where none belongs. This flag alone catches the majority of targeted email fraud, including the payment-redirection scams that cost Australian businesses millions (Scamwatch). If the domain is not exactly the one you know, stop.
3. Urgency with a deadline
"Within 24 hours", "final notice", "account will be suspended today". Manufactured urgency exists to make you act before you verify. Treat any deadline in an unexpected email as a flag in itself — and if the matter is genuinely urgent, the sender will still exist in ten minutes when you have checked by phone.
4. Authority applying pressure
"The CEO needs this paid before she boards a flight." Executive impersonation works because it borrows your respect for hierarchy. Executives do not need payments kept secret from finance, and they do not need a junior employee to bypass the process. This is also the emotional core of business email compromise — we break down the full BEC attack pattern separately.
5. A change to bank details
No legitimate supplier changes payment details by email alone — and even if one did, the change must be verified by phone on a number you already hold, never one supplied in the email. Treat every bank-detail change as fraud until proven otherwise.
6. An MFA code or approval prompt you did not trigger
A one-time code arriving unasked means someone already has the password and is trying to get past the second lock. Never read a code back to anyone, never approve the prompt — and change that account's password immediately.
7. A login link that does not match the service
Hover over the button before clicking. "Sign in to Microsoft 365" pointing to microsoft-login.verify-account.ru is not subtle once you look. Also watch for links that match the brand but not the context: a Dropbox link from your bank is wrong even if the domain is real.
8. An unexpected attachment
Invoices, "scanned documents", voicemail files and shipping notices you did not expect are the classic malware delivery. Do not open it — especially not a .html, .zip or Office file that asks to "enable content". If it claims to be from a known contact, confirm they sent it through another channel.
9. A generic greeting or a mismatched one
"Dear customer" from a bank that knows your name is a flag — but so is "Hi Sarah" when your name is Sarah and the email is from a supplier you have never dealt with. Attackers harvest names; a correct name proves nothing, while a wrong one or a generic one proves a lot.
10. A request for secrecy
"Keep this confidential", "don't loop in accounts", "I'm in a meeting, just action it". Isolation is a weapon: the request only works if nobody checks it. Any request that asks you to skip the normal process is asking you to skip the control that stops fraud.
11. QR codes and images instead of text
Quishing — phishing via QR code in the email body or an attached image — exists precisely because it hides the link from hover checks. Treat a QR code in an unexpected email the same as a link you cannot inspect: verify with the sender through a channel you already trust first.
12. Strange greetings in the reply chain, or replies to threads you never started
A forwarded thread where the earlier messages use different names, formats or signatures than your company's real threads is usually a copied thread. Same for a reply to a conversation that does not exist in your Sent folder. Check the thread against the real one before trusting it.
What to do when you spot a flag
Do not click, do not reply, and do not call any number inside the email. Verify through a channel you already hold: the supplier's account manager, the executive in person, the bank's number from your card. Then report it — internally via your report button, and to the authorities if it was an attack attempt: how to report a phishing email covers the Australian channels in order, and what to do after clicking a phishing link covers the recovery if you acted before you checked.
Train the checks so they become reflexes
Knowing twelve flags and applying them under deadline pressure are different skills. That gap is what a simulation programme measures: monthly phishing simulations rehearse exactly these lures in a safe environment, and anyone who clicks is auto-enrolled in a short lesson on that specific tactic the same week. Human risk reporting then shows whether clicks trend down and reporters trend up, person by person, instead of leaving the verdict to a quarterly gut feel.
For teams building the programme from scratch, security awareness training pairs the monthly lesson content with the simulation calendar, and the 2026 MSP buyer's guide shows how platforms differ on automation and evidence. If you would rather measure where your gaps actually sit before spending, a security gap assessment scores the human layer alongside MFA, patching and backups.
FAQ
What is the single most reliable phishing red flag? The sender's actual domain. Display names, logos and signatures are trivially faked; the registered domain is what the attacker had to buy, and it is where lookalikes slip.
Are phishing emails full of spelling mistakes? Much less than they used to be. AI assistance has cleaned up the grammar, so poor spelling is now a weak signal — the domain, the urgency and the request itself are the stronger ones.
I clicked before noticing a red flag. What now? Follow the incident steps: disconnect the device, change any credentials you entered from a different device, check inbox rules, then report. The full order is in our guide to what to do after clicking a phishing link.
How do I check a link without clicking it? Hover over it on desktop — the destination appears in the corner of the browser or as a tooltip. On a phone, press and hold to preview. Read the domain immediately before the first single slash; everything after it is decoration.
Should I report an email I only suspected? Yes. Reports from people who spotted the scam are the fastest early warning IT gets — the message can be pulled from every other mailbox before anyone clicks.
One last thing
You do not need to memorise twelve flags — you need one habit: when an email asks you to act, pause and check the sender's domain before anything else. That single pause catches most of what reaches an inbox in 2026.