The era of clumsy, misspelled phishing is over. Today's messages carry your accountant's tone, quote the correct invoice number, and often appear to continue a genuine conversation.
Short answer: how do you recognise a phishing e-mail?
You recognise modern phishing not by spelling errors but by the behaviour it requests: if a message asks for urgent action, a change to payment details, or an identity verification, treat it as suspect — even when the sender name is familiar. Technical checks help too: the sender's real domain, where the link actually points, and whether the message belongs to an expected conversation. But the decisive question is: does this request normally arrive this way in our workflow?
Six signs of modern phishing
| Sign | How it appears | How to check |
|---|---|---|
| Pressure of urgency | "If not paid today", "your account will close" | Urgency exists to prevent thought; pause |
| Change of payment details | A known supplier announces "new bank details" | Confirm by phone on a number you already hold |
| Lookalike domain | One letter different, or a different extension | Read the sender address letter by letter |
| Attached to a real thread | Arrives as a reply within an old conversation | Check every address in the thread |
| Verification request | A link saying "your session must be verified" | Do not click; navigate to the site yourself |
| Unusual channel | A director who never e-mails suddenly does | A change of channel is a warning in itself |
What these six share: none depends on spelling mistakes. Today's messages can be linguistically flawless; what distinguishes them is the behaviour requested.
BEC: the impersonation attack
- Observation. From a compromised or imitated account, the attacker watches correspondence: who writes to whom, in what tone, on what payment cycle, and with which suppliers.
- Timing. The request arrives during a genuine payment period, so it does not look unexpected.
- Authority and pressure. The message appears to come from senior management and usually includes a line that blocks verification, such as "I'm in a meeting, don't call".
- Channel capture. The reply address is altered so the conversation continues at an address the attacker controls.
What stops this attack is not technology but a rule: changes to payment details are never approved over e-mail. A single verification call on a known number neutralises the whole scheme.
Three steps when a suspicious message arrives
- Stop and do not click. Close the message before touching any link or attachment. The sense of haste is part of the design.
- Verify through an independent channel. Call the number in your own records, not the one in the e-mail. Verifying by replying may mean talking to the attacker.
- Report it. Suspicious or not, forward the message to whoever runs your systems. The same message has probably reached others; early reporting protects the whole team.
If someone did click, speed matters more than panic: change the password, terminate sessions, check two-factor settings, and report.
What can be done technically
- Complete your SPF, DKIM and DMARC records. These block forged messages sent in your domain's name — protecting your customers too. Setup is covered in our e-mail configuration article.
- Flag external e-mail. A visible marker on messages from outside the organisation makes internal impersonation markedly harder.
- Use strong authentication on critical accounts so a stolen password is not sufficient on its own.
- Monitor lookalike domains. Watching new registrations resembling your brand provides early warning.
- Run payment approvals through a system. E-mail is not an approval channel.
Netişlem expert view: the target is the workflow, not the system
Today's phishing does not look for technical flaws; it looks for gaps in the workflow. How payment approvals are given, who instructs whom through which channel, and when verification gets skipped. Once an attacker learns those, no software vulnerability is needed. Which is why the most effective countermeasure is not technical either: a written verification rule.
Our second observation is that the greatest damage comes from "familiar" messages. Teams stay cautious with unknown senders; an invoice from a known supplier in the right tone goes unquestioned. That threshold of trust is precisely the target.
Third, reporting must never be punished. In the incidents we examine, the most common reason damage grows is that the person who clicked said nothing for hours. A culture of "saying so causes no problem; staying silent causes a big one" is worth more than most technical measures.
Team awareness checklist
- A written verification rule exists for payment detail changes and everyone knows it.
- Verification uses recorded contact details, not those in the e-mail.
- External e-mail is visibly flagged.
- SPF, DKIM and DMARC records complete and verified.
- Two-factor authentication active on critical accounts.
- A reporting channel for suspicious messages exists and reporting is encouraged.
- Short awareness sessions held twice a year.
- Steps to follow after a wrong click are written down.
Frequently asked questions
If the sender name looks right, can I trust it?
No. Display names are trivial to change; the real address is what counts. Attacks that spoof the address exist too, so checking the address alone is not enough either. Base your judgement on the type of request and your verification rule.
Can I be harmed without opening the attachment?
Clicking a link, landing on a fake login page and entering credentials there is the most common route to harm — with no attachment opened at all. "I didn't open the attachment" is not, by itself, reassurance.
Doesn't the spam filter catch these?
It catches some. But messages containing no malware, written for a single recipient and fitting a genuine conversation are the hardest kind for filters to distinguish. In those attacks, the user is the last line of defence.
Should I run simulated phishing tests?
They are useful when set up properly. The aim should be measuring awareness rather than catching people. Not sharing individual results and following the test with a short briefing keeps the method constructive.
What if fake e-mails are going out to my customers?
First tighten your domain's authentication records; a correctly configured DMARC policy can have forged messages blocked at the recipient's end. Informing customers and reminding them of your official channels also matters for reputation.
Conclusion
What stops phishing today is no longer careful reading but a written verification rule. As long as critical actions such as payments and access are never approved over e-mail, no message — however convincing — produces a result.
If you would like us to audit your e-mail security, get in touch. You can review our corporate e-mail and secure hosting solutions.