Most scam emails can be caught in under a minute, before anyone clicks. This guide is for everyone in the office, whether you use Outlook or Gmail. Keep it handy, and when you’re not sure, ask before you click.
The 60-second check
- Were you expecting it? Unexpected invoices, “shared documents”, voicemail notices and password warnings are the usual bait.
- Check the real sender address, not just the name. Click or tap the sender’s name to see the full address. Look for one letter swapped, an extra word, or a free Gmail or Outlook address claiming to be a company.
- Hover over links before you click (on a phone, press and hold). Does the address that pops up go where the email says it does?
- Is it rushing you? “Today”, “final notice”, “your account will be suspended”. Pressure is the point: it stops you from thinking.
- Is it about money or sign-ins? New bank details, gift cards, “confirm your password”. Call the person on a number you already have, never the one in the email.
If any answer worries you, don’t click, don’t reply and don’t open attachments. Send it to your IT contact or report it (below).
Still not sure? Send it to IT as an attachment
Forwarding it as an attachment lets your IT contact see the hidden details (the email’s headers) that show where it really came from.
- New Outlook and Outlook on the web: select the message, click … (More actions), then Forward > Forward as attachment.
- Classic Outlook for Windows: select the message, then on the Home tab click More (next to Forward) > Forward as Attachment.
- Gmail on a computer: open the email, click ⋮ (More) at the top right, then Forward as attachment.
Phone apps usually can’t forward as an attachment. Forward it normally and tell your IT contact it’s suspicious, or wait until you’re at a computer.
Report it
- Outlook: select the message, click Report, then Report phishing. The steps for each version of Outlook are in How to spot and report a phishing email in Outlook.
- Gmail on a computer: open the email, click ⋮ (More) at the top right, then Report phishing. In Google Workspace, your admin can see these reports.
- Gmail app: open the email, tap ⋮ (More) at the top right, then Report phishing if it’s offered, or Report spam.
Reporting removes it from your inbox and helps block similar messages. Don’t forward it to coworkers to ask “is this real?”
If you already clicked or typed your password
Don’t panic, and don’t hide it. The first few minutes matter most.
- Tell your IT contact straight away.
- If you typed a password, change it from a different device, and anywhere else you use the same password.
- Approve no sign-in prompts you didn’t start. If you already approved one, say so.
- If you opened an attachment, disconnect the computer from Wi-Fi or the network until it’s checked.
- Watch for things you didn’t do: emails in your Sent folder you didn’t write, or new rules that forward or move your mail.
Practice on real-world examples
Every week we post a made-up example of the kind of email going around, with the warning signs circled. See this week’s “Is this email safe?” example.
Related
- How to spot and report a phishing email in Outlook
- Managed security and security awareness training
- Fake invoices with new bank details: how to stop the scam
More guides
- Microsoft 365 admin: add staff, reset passwords and offboard someone who leaves
- Microsoft 365 Copilot: what it does, where to find it, and how to use it safely
- Set up Microsoft Authenticator and Outlook on your phone (iPhone and Android)
- How to check your email's SPF, DKIM and DMARC records (and what the results mean)
- How to send an encrypted email in Outlook (Microsoft 365)
- How to open an encrypted email sent from Microsoft 365 (Outlook)
- What goes in a WISP: a checklist for small tax offices
- Share files with clients securely from OneDrive (expiring links, no attachments)
- Hand over HOA or office email when a board member or manager changes
- How to spot and report a phishing email in Outlook
- Get back a deleted email or file (Microsoft 365 and Google Workspace)
- Turn on 2-step verification in Google Workspace (and keep your backup codes)
- Google Workspace admin: add staff and offboard someone who leaves
- Share files with clients securely from Google Drive
Microsoft and Google change their menus from time to time, so a button may have moved. These guides are general information for small businesses; check with your IT provider before changing settings that affect everyone.