The Email Looked Completely Normal
"Dear Mr. Müller, please find attached the updated invoice for November. Please transfer the amount by the 15th of the month." – That's how the email began that nearly cost one of my clients €47,000.
The sender? Supposedly their long-standing supplier. The email address? Correct at first glance. The attachment? A perfectly forged PDF invoice with the correct customer number, right address, and plausible amount. Only the bank details were different.
Phishing in 2026 is no longer amateurish. It's a highly professional industry that uses AI tools to craft emails that even security experts find hard to identify.
What Phishing Actually Is – And Why It Works
Phishing is the attempt to obtain confidential information through fake emails, websites, or messages – passwords, banking details, credentials for company systems.
It works because it exploits human psychology:
- Time pressure: "Your account will be locked in 24 hours"
- Authority: "The CEO urgently requests..."
- Fear: "Unusual activity detected on your account"
- Curiosity: "Your order has been shipped" (even though you didn't order anything)
- Greed: "You've won!" or "Bonus payment approved"
The 10 Signs of Dangerous Emails
1. The Sender Address Doesn't Quite Match
This is still the most reliable check. But be careful: Attackers use addresses like:
- support@amaz0n.com (zero instead of O)
- billing@telekom-service.net (real domain: telekom.de)
- info@deutsche-bank-security.com (subdomain trick)
Tip: Click on the sender name and check the actual email address behind it. When in doubt: Call the supposed sender – but use the number from their official website, not from the email.
2. Unusual Greeting or Wrong Personalization
"Dear Customer" instead of your name? Or your name is correct but the company name is wrong? Both are suspicious. Modern phishing emails use data from LinkedIn and other sources to appear personal.
3. Urgency and Time Pressure
"Act immediately," "within 24 hours," "your account will be locked" – legitimate companies rarely put you under extreme time pressure via email. If an email tries to create panic, that's a warning sign.
4. Links to Fake Websites
Hover your mouse over links (don't click!). The URL in the status bar should belong to the expected domain. Watch out for:
- Additional words: login-bank-security.com
- Different top-level domain: bank.com.ru
- Slightly altered spelling: bnak.com
5. Unexpected Attachments
Particularly dangerous are:
- .exe, .bat, .cmd, .scr – Executable files (never open!)
- .docm, .xlsm – Office files with macros
- .zip, .rar – Compressed files (often hide malware)
- .pdf – Can contain JavaScript or lead to fake login pages
6. Language Errors – But Not Always
Bad grammar used to be a clear sign. In 2026, things are different. AI tools produce perfect language. Still: Watch for subtle errors, unusual phrasing, or a style that differs from the sender's usual tone.
7. Request to Enter Sensitive Data
No reputable bank, provider, or service provider will ask you via email to enter passwords, PINs, or TANs. Never. If an email does this, it's phishing.
8. Different Bank Details
For invoices via email: Always compare the bank details with previous invoices. Has the IBAN changed? Call the sender and confirm the change by phone.
9. Offers Too Good to Be True
"You have a €500 credit," "Free iPhone giveaway," "Exclusive employee bonus" – if it sounds too good to be true, it usually is.
10. Missing or Fake Signature
Legitimate business emails have a complete signature with name, position, phone number, and company address. Is it missing or unprofessional? Be careful.
What to Do When You Suspect Phishing
- Don't click, don't reply, don't open attachments
- Report the email – to your IT department or IT service provider
- Verify the sender – through a separate channel (phone, in person)
- Delete the email or move it to quarantine
- If you clicked: Immediately change passwords, inform IT, have systems checked
Phishing Protection for Businesses: Technical Measures
Beyond employee awareness, there are technical measures that prevent phishing emails from reaching the inbox:
Set Up Email Authentication
- SPF (Sender Policy Framework): Defines which servers are allowed to send emails for your domain
- DKIM (DomainKeys Identified Mail): Digital signature for outgoing emails
- DMARC (Domain-based Message Authentication): Determines what happens with unauthenticated emails
These three protocols together reduce the probability of someone sending emails in your name by over 99%.
Additional Technical Measures
- Email Gateway with AI-based detection (e.g., Microsoft Defender for Office 365)
- Link Rewriting: URLs in emails are routed through a security proxy when clicked
- Sandbox Analysis: Attachments are opened and tested in an isolated environment
- Impersonation Protection: Detects when someone pretends to be a CEO or supplier
Security Awareness Training: The Most Important Protection
Technology alone is not enough. People are the last line of defense – and simultaneously the biggest vulnerability. Regular training is mandatory:
- Send simulated phishing emails and evaluate results
- Quarterly short training sessions (15-20 minutes)
- Gamification: Rewards for reporting suspicious emails
- Updates: Present new attack methods (AI-generated deepfake emails, voice phishing)
Fun Fact: Companies that regularly conduct simulated phishing tests reduce the click rate on real phishing emails by up to 80% within one year.
Conclusion: Healthy Skepticism Is Your Best Protection
Phishing is becoming increasingly sophisticated, but the basic rules remain the same: Don't trust blindly, check senders and links, and report suspicious emails. Combined with technical protective measures and regular training, you make it significantly harder for attackers.
Want to improve phishing protection in your company? We offer Security Awareness Training and simulated phishing campaigns specifically for SMEs. Let's talk.
