Phishing Red Flags I'd Teach a New Hire on Day One

When I onboarded new users at a manufacturing plant with more than 1,200 people, my checklist was mostly practical: create the account, set up the machine, show them the systems they'd use and how to reach the help desk. Looking back, I'd add one more item to that checklist and give it as much time as everything else: how to recognize a phishing message.

Phishing is still one of the most common ways attackers get into organizations. It doesn't require breaking through a firewall. It only requires one person, in a hurry, trusting a message they shouldn't. New hires are especially exposed. They don't yet know what normal looks like, who usually sends what, or which requests are unusual.

So here are the red flags I'd teach on day one, in plain language, along with the one habit that stops most attacks.

What phishing actually is

Phishing is a message designed to trick you into doing something that helps an attacker. That "something" is usually one of four things:

1. Entering your password on a fake login page.
2. Opening an attachment that installs malware.
3. Sending money or information, such as paying a fake invoice or sharing employee records.
4. Approving access, for example accepting a multi-factor authentication prompt you didn't start.

It doesn't only arrive by email. It comes by text message (sometimes called smishing), phone call (vishing), chat apps, social media and even QR codes. The tactics are the same across all of them.

Red flag 1: Pressure and urgency

Almost every phishing message tries to rush you. "Your account will be locked in 30 minutes." "Payment must be made today or the shipment is cancelled." "I need this before my meeting."

Urgency is effective because it pushes people to act before they think. Real organizations rarely require you to act within minutes through an email link. When a message makes you feel rushed, treat that feeling as a warning sign, not an instruction.

Red flag 2: An unusual request from a familiar name

One of the most damaging forms of phishing impersonates someone you know: your manager, a senior executive, a colleague in finance or a regular supplier. The message might ask you to buy gift cards, change a supplier's banking details or send a file "quickly, I'm in a meeting."

The name looks right, but the request doesn't match how that person normally works. Ask yourself: would this person usually ask for this, in this way? If not, verify it.

Red flag 3: The sender address doesn't quite match

Display names are easy to fake. Always check the actual email address behind the name. Common tricks include:

• Look-alike domains, such as swapping a letter or adding a word: "examp1e.com" or "example-payroll.com."
• Free email accounts pretending to be a company or a senior employee.
• A "reply-to" address that's different from the "from" address.

Many organizations add a banner to emails from outside the company. If a message from your "CEO" carries an external warning, that's worth a second look.

Red flag 4: Links that go somewhere unexpected

Before clicking any link, hover over it on a computer, or press and hold on a phone, to see where it actually leads. The text might say "Microsoft 365 login," but the address could be something completely different.

Look closely at the domain name, the part just before the first single slash. Attackers use long addresses that include a trusted name early on, like "login.microsoft.com.secure-check.net." The real destination there is "secure-check.net," not Microsoft.

Better still: don't use email links to log in to important accounts. Go to the site directly through a bookmark or by typing the address you know.

Red flag 5: Unexpected attachments

Invoices you weren't expecting, "scanned documents," shipping notices, voicemail files and resumes are common phishing lures. Be especially careful with compressed files (.zip), documents that ask you to "enable content" or "enable macros," and HTML files that open a login page.

If you weren't expecting an attachment, confirm with the sender through a separate channel before opening it.

Red flag 6: Requests for credentials or MFA codes

No legitimate IT team will ask you to send your password by email or chat. And no one should ever ask for the code from your authenticator app or text messages.

A newer tactic is "MFA fatigue": an attacker who already has your password triggers login prompts over and over, hoping you'll approve one just to make them stop. If you get a sign-in prompt you didn't start, deny it and tell IT right away. It means someone may already know your password.

Red flag 7: Something just feels off

Spelling and grammar mistakes used to be a reliable sign of phishing. That's less true now, because attackers can produce polished messages easily. So don't rely on bad grammar to protect you.

Instead, notice context. Is the timing strange? Is the tone unusual for the sender? Does the message reference something you never did, like a package you didn't order or a password reset you didn't request? Trust that instinct.

Three scenarios worth practising

Red flags are easier to remember when you've seen them in context. Here are three common scenarios I'd walk a new hire through.

The supplier who changed banks. An email arrives from a familiar supplier, using their normal tone and signature. It says their bank details have changed and asks you to update them before the next payment. The sender address is one character different from the real one. This is a classic payment fraud attack, and it works because the request is plausible. The defence: never change payment details based on an email alone. Call the supplier on a number already on file.

The shared document. You receive a notification that a colleague has shared a file with you. Clicking the link opens a login page that looks exactly like your company's sign-in screen. But you weren't expecting a file, and the address bar shows an unfamiliar domain. The defence: close the page and open the document from your usual file-sharing app instead. If it's real, it will be there.

The helpful IT call. Someone phones claiming to be from the IT help desk. They say your account has a problem and they need you to read out the code that's about to arrive on your phone. They sound professional and know your name and manager's name, perhaps from public profiles. The defence: IT will never need your MFA code. Hang up and call the help desk on the number you already know.

In each case, the attacker uses something real: a real supplier, a real file-sharing service, real names. That's what makes phishing convincing, and why verification matters more than spotting typos.

The one habit that stops most attacks

If I could teach only one thing, it would be this: verify through a second channel.

If a message asks you to log in, pay, change details, share data or approve access, confirm it using a contact method you already know, not one provided in the message. Call your manager on the number you have saved. Message the colleague on your normal chat tool. Look up the supplier's phone number yourself. Log in to the service by typing its address.

That one pause breaks the attacker's plan, because phishing relies on keeping you inside their conversation.

What to do if you clicked

Mistakes happen, even to experienced IT people. What matters is what you do next.

1. Report it immediately to IT or security. Don't wait to see if anything happens.
2. If you entered a password, change it right away, starting with that account and any others where you used the same password.
3. If you opened an attachment, disconnect from the network if IT asks you to, and leave the device on so it can be examined.
4. Don't delete the message. It's evidence that helps the team protect others.

One message I'd stress to every new hire: you will never be in trouble for reporting a suspicious message, even if it turns out to be harmless, and even if you clicked. Early reports are how security teams contain attacks before they spread. On a help desk, the fastest incidents to resolve were always the ones someone reported quickly and honestly.

For the people running onboarding

If you're responsible for setting up new employees, consider adding a short phishing briefing to the first day:

• Show two or three real examples your organization has received, with sensitive details removed.
• Explain how to report a suspicious message, ideally with a one-click "report" button.
• Tell new staff what IT will never ask for.
• Make it clear that reporting is welcomed, not punished.

It takes fifteen minutes, and it could prevent the most expensive mistake a new employee ever makes.

What's the most convincing phishing attempt you've ever seen?