Phishing Red Flag Library

Display name matches a known contact but the actual email address is from a free webmail service like Gmail or Yahoo.

The sender domain uses a lookalike, rnicrosoft.com instead of microsoft.com, or amaz0n.com instead of amazon.com.

Email claims to be from a C-level executive but was sent from an unfamiliar domain or at an unusual time (e.g., 3 AM local time).

Email comes from a domain registered very recently, within the last 30 days. Check via WHOIS lookup.

The 'Reply-To' address differs from the 'From' address, often set to a Gmail, Protonmail, or other free account.

Sender uses a domain that is one character off from your company's domain (e.g., yourcompany.co instead of yourcompany.com).

The email was sent via a consumer email marketing platform (Mailchimp, Constant Contact) but claims to be a direct business communication.

Email comes from a healthcare provider or insurer domain you've never communicated with before, requesting patient data or login credentials.

The sender claims to be from a government agency (IRS, FBI, HHS, CISA) using an unofficial domain or a Gmail address.

The email claims to be from Microsoft 365, Google Workspace, or your IT help desk but uses an external domain.

Email address uses a string of random characters before the @ sign (e.g., d7x92kq@company.com) or an implausible name.

The sender's email domain was registered in a country that has no business relationship with your organization.

Email claims to be from a court, law firm, or regulatory body regarding a complaint or subpoena, but uses threatening language unusual for official correspondence.

The email appears to come from a payroll or HR system (ADP, Paychex, Gusto, Workday) about a 'direct deposit change' or 'W-2 request.'

Email from a real-estate title company, escrow officer, or lender uses a slightly altered domain, caught only by examining the email headers.

A vendor you work with sends an invoice from a new email address claiming they've 'updated their billing system.'

Email comes from a 'no-reply' or 'do-not-reply' address but asks you to take urgent action or click a link.

Sender claims to be from your organization's insurance broker requesting policy details, employee counts, or renewal information.

Email appears to be from a known contact but the writing style, signature format, and vocabulary are noticeably different.

Sender uses Unicode homoglyphs in the display name, replacing Latin 'a' with Cyrillic 'а' (U+0430) which renders identically in most fonts.

Subject line begins with 'URGENT:' 'ACTION REQUIRED:' 'IMMEDIATE ATTENTION:' or similar all-caps urgency markers.

Subject line references a specific dollar amount or financial penalty: 'Your account will be charged $499.99.'

Subject line contains 'Re:' or 'Fwd:' when the email is actually a first contact, the thread is fabricated.

Subject line uses emotional manipulation: 'I thought you should see this,' 'Is this you in this photo?', or 'I can't believe this happened.'

Subject line threatens account closure: 'Your email will be deactivated in 24 hours' or 'Final notice: Mailbox suspension.'

Subject line references a package delivery you weren't expecting: 'Your FedEx package #847291 is on hold' or 'USPS delivery attempt failed.'

Subject line references a voicemail or missed call: 'You have a new voicemail from (415) 555-0192' or 'Missed call from Unknown.'

Subject line contains obvious spelling or grammar errors: 'Your accont has been compromized' or 'Verify your acount now.'

Subject line uses excessive punctuation: 'Important!!!!' or 'Please read...' or '??? Urgent ???'.

Subject line references a shared document or file you didn't request: 'John shared a document with you' or 'You've been granted access to a file.'