A suspicious message lands in your inbox, and your first instinct is to find out what it wants. That instinct is exactly what attackers count on. A single phishing email is now the most common way criminals break into business accounts, steal credentials, and launch ransomware. The good news is that the right response takes only a few minutes. We put together this guide so you and your team know exactly what to do the moment one shows up.
First, Do Not Take the Bait
When a suspicious message arrives, the safest move is to slow down. Attackers design these emails to trigger quick, emotional clicks. Before you do anything, avoid these four mistakes:
- Do not click any links or buttons. Even a “view invoice” or “unsubscribe” link can load malware or a fake login page.
- Do not open or download attachments. Files are a common way attackers deliver viruses and ransomware.
- Do not reply. A response confirms your address is active and invites more attempts.
- Do not call numbers listed in the message. Scammers often staff their own fake support lines.
Pro Tip: A polished, error-free message is no longer proof that an email is safe. Many attacks now read perfectly, so judge the request itself, not the grammar.
What to Do When a Phishing Email Arrives
Once you recognize the threat, a short routine keeps you protected.
Verify Before You Trust
If the email claims to be from your bank, a vendor, or a coworker, confirm it through a separate channel:
- Open a new browser tab and type the company’s real website address yourself.
- Call the number printed on your statement, card, or the official site.
- Message the coworker directly through a known phone number or chat.
How to Report a Phishing Email
Reporting protects your whole organization, not only you. Use the tools built into your inbox, then escalate:
- Gmail: Open the message, click the three-dot menu, and select Report phishing.
- Outlook or Microsoft 365: Choose Report, then Report phishing.
- At work: Notify your IT team or managed provider first so they can block the sender for everyone.
- Authorities: Forward reports to reportphishing@apwg.org, and report fraud to the FTC at reportfraud.ftc.gov or the FBI at ic3.gov.
After reporting, delete the message so you do not open it again by mistake.
Key Takeaway: Reporting fast does more than clear your inbox. Quick alerts let your security team contain a threat before it spreads to coworkers and clients.
Already Clicked? Your First 15 Minutes Matter
Mistakes happen, especially when a message looks urgent. If you clicked a link, opened a file, or entered a password, act quickly and in order:
- Disconnect the device from Wi-Fi or unplug the network cable.
- Tell IT or your provider right away if it is a work device or account.
- Change your passwords from a clean device, starting with email and any account that shared that password.
- Turn on multi-factor authentication everywhere it is not already active.
- Run a full security scan with updated antivirus software.
- Watch your accounts. If you shared bank or Social Security details, contact your bank and visit IdentityTheft.gov.
Key Takeaway: Speed is your best defense. Breaches that go unnoticed can take months to contain, so a same-day response often decides how much damage an attacker can do.
Worried your team would not know what to do? Our cybersecurity specialists help Kansas City businesses train employees, secure email, and respond to threats fast. Contact MDL Technology for a free consultation.
Why Spotting Today’s Attacks Is Harder
Phishing has changed, and old advice has not kept up.
The Typo Rule No Longer Works
For years, people were told to watch for bad spelling and clumsy wording. Attackers now use AI to write clean, personalized messages that copy a real brand or executive almost perfectly. The message may include accurate names, projects, and details pulled from public sources.
Attacks Often Cross Channels
A single email is rarely the whole plan anymore. A common tactic pairs an email with a follow-up phone call from someone posing as IT support, asking why you have not clicked yet. Voice cloning and fake video calls have also been used to approve fraudulent payments, which makes verification more important than ever.
Pro Tip: Set a simple company rule that no payment or password change is ever approved by email or phone alone. A quick second check through a trusted channel stops most business email scams.
How Businesses Can Stay Protected
Strong habits and the right tools turn one risky click into a non-event. We recommend:
- Employee training with realistic phishing simulations, including combined email and phone tests.
- Advanced email filtering to block known threats before they reach inboxes.
- Multi-factor authentication on every account.
- Endpoint detection and response to catch activity that basic filters miss.
- A written incident response plan so everyone knows their role.
The Bottom Line
A suspicious message does not have to become a crisis. When you pause, verify, report, and delete, you protect your accounts, your coworkers, and your clients. For businesses, the strongest defense pairs alert employees with layered security and a clear plan. If you want expert help building that protection, our team is ready to assess your risk and keep your business safe from the next phishing email.
