How to spot a phishing email or text — and what to do next

Phishing is still one of the most common ways attackers reach a small or medium business: a message that looks routine, then a click, a login page or an attachment that should never have been opened. This guide summarises official Canadian guidance in plain language so your team knows what to look for and what to do next.

What phishing looks like

The Canadian Centre for Cyber Security describes phishing as a scam delivered by email, text, phone or social media that tries to make you click a malicious link, download malware or share sensitive information. Messages often pretend to come from a bank, courier, software vendor or a colleague.

Get Cyber Safe lists seven red flags that are still useful even when the wording looks professional:

• Urgent or threatening language, including a deadline or a threat to close an account.
• A request for passwords, payment details or a login through a link in the message.
• An offer that sounds too good to be true.
• Unexpected receipts, delivery notices or account alerts you did not start.
• A sender address or link that is close to, but not the same as, the real organisation.
• An attachment or QR code you did not ask for.
• Blurry logos, poor formatting, or a message made only of images.

The Cyber Centre also notes that AI-written phishing can look clean, with fewer spelling mistakes than older scams. Treat unexpected requests as suspicious even when the grammar looks fine.

What to do when a message looks wrong

• Do not click the link, open the attachment, reply, or scan a QR code from the message.
• Do not enter a password on a page you reached from that message. Open a new browser tab and type the organisation’s usual address yourself, or use a bookmark you already trust.
• If you need to check whether the request is real, use a separate channel you already have — for example a known phone number or the vendor’s signed-in portal — not the contact details in the suspicious message.
• Report the message to whoever handles IT in your business. Do not forward it to colleagues “just in case”.
• Canadians can also report phishing to the Canadian Centre for Cyber Security and the Canadian Anti-Fraud Centre.

What helps at the organisation level

Staff awareness matters, but it is not the only control. The Cyber Centre’s email security guidance also points to spam and phishing filters, and to domain protections such as DMARC, so forged mail is harder to deliver. Multi-factor authentication on email and Microsoft 365 accounts reduces the damage if a password is stolen. Keep devices and browsers updated so known malware is harder to run.

If someone already clicked or entered credentials, disconnect that device from the network, reset the password from a different trusted device, and contact IT support. Techloom can review mail filtering, Microsoft 365 settings and everyday device hygiene as part of a security assessment or managed IT support.

Sources

Don’t take the bait: Recognize and avoid phishing attacks (ITSAP.00.101), Canadian Centre for Cyber Security. The 7 red flags of phishing, Get Cyber Safe. Email security best practices (ITSM.60.002), Canadian Centre for Cyber Security.