TOOLBOX · DOWNLOAD
Recognizeand reportphishing.
Phishing messages often look genuine today: flawless language, a familiar logo, a seemingly trusted sender. This cheat sheet shows the typical warning signs with an example and a way to check each one. It covers special forms, from CEO fraud to QR codes and calls to MFA requests you did not trigger, and what to do immediately after a click. It also includes the reporting channels in Austria and a template for your internal contacts. The guidance is based on BSI, the Austrian Federal Criminal Police Office (Bundeskriminalamt), Watchlist Internet, Microsoft, and CISA.
Free PDF · Cheat sheet
Recognizing Phishing: Cheat Sheet for Employees
- Topic
- Security Basics
- Format
- PDF, A4
- Length
- 8 pages
- Size
- 109 KB
- Updated
- Oct 25, 2026
- Sources
- 10
- Usage
- Redistribution in unchanged form permitted
WHO IT IS FOR
Who This
Is for.
Warning signs, checking steps, and special forms of phishing, what to do after a click, and how to report correctly in Austria.
- All employees who handle email, text messages, chats, and calls, no IT knowledge required
- Managers who share the cheat sheet, post it, or use it in training
- Accounting, purchasing, and assistants who initiate or approve payments
- IT managers who define reporting channels and plan training
8 SECTIONS
What Is
Inside.
- 01
The Basic Rule: Pause, Check, Report
Phishing comes via email, text message, chat, phone call, or QR code. Flawless language is no all-clear.
- 02
Six Warning Signs and How to Check Them
Sender, pressure, links, attachments, unusual requests, and requested data: feature, example, and way to check.
- 03
Check in Six Steps
How to clarify a suspicious message without using any link, attachment, or phone number from the message.
- 04
Special Forms: CEO Fraud, QR Codes, Text Messages, Calls, MFA
How to recognize fraud that does not look like a classic phishing email, and how to respond.
- 05
After a Click: Act Immediately
What to do immediately, depending on the situation. At work, inform IT first (Microsoft); IT decides on the next steps.
- 06
Report Correctly: Internally and in Austria
First the internal channel, then Outlook, Watchlist Internet, the cybercrime reporting office, and the police.
- 07
Checklist to Post
Ten questions before every click, every entry, and every payment, as a TOMORIS recommendation.
- 08
For Managers and IT: Set the Framework
What managers and IT define so that employees report and your own domain is hard to spoof.
EXCERPT
Six Warning Signs and How to Check Them
| Feature | Example | How to check |
|---|---|---|
| Sender does not match | Display name “IT Service,” but an unfamiliar address behind it; a domain with extra numbers or altered letters | Hover over the sender line without clicking: a different address may be behind it (BSI). If the signature does not match the address, that is a warning sign (Microsoft). |
| Pressure and threats | “If you don't do this, we will unfortunately have to block your account …” | Don't let yourself be pressured (Federal Criminal Police Office). Clarify the matter yourself via the known website or number. |
| Link leads somewhere else | A “Confirm account” button with a random string of characters, a short link, or an address such as “www.135x-Bank.de” behind it | Hover over the link, or press and hold it on a smartphone: the real destination address appears (Watchlist Internet). “https://” is no all-clear (BSI). |
| Unexpected attachment | Extension .exe or .scr, a double extension such as .pdf.exe, a request to enable macros | Don't open attachments of suspicious emails (BSI). If a file asks you to enable macros or install something, that is a clear sign (Microsoft). |
| Unusual request | Management writes from a private address and demands an urgent, confidential transfer | Become suspicious when a known sender makes an unusual request (BSI). Call the person back through a known channel (Watchlist Internet). |
| Confidential data requested | Password, PIN, TAN, or credit card number by email, text message, form, or phone | Banks and authorities never ask for your password by email (BSI), and bank employees never ask for your TAN (Federal Criminal Police Office). |
One feature is enough to be suspicious. The BSI lists urgent calls to action, threats, requests for confidential data, links or forms, and unusual requests from known senders: if at least one applies, it is very likely phishing.
- The message arrives unexpectedly, for example from someone you rarely deal with (Microsoft).
- The “To” field contains many seemingly random recipients (Microsoft).
- The greeting is impersonal, such as “Dear customer” (Federal Criminal Police Office).
SOURCES
Supported
by Sources.
- BSI: How do I recognize phishing emails and websites? (opens in a new tab)Recognizing phishing emails, recognizing phishing websites; accessed October 25, 2026
- BSI: Phishing and its subtypes smishing, quishing, and vishing (opens in a new tab)Smishing, quishing, vishing; accessed October 25, 2026
- BSI and ProPK: Phishing, emergency checklist (PDF) (opens in a new tab)What you should do if …; How to protect yourself in the future
- Federal Criminal Police Office: Phishing/Smishing fact sheet (PDF, October 2025) (opens in a new tab)Warning signs, prevention recommendations, measures in case of damage
- Watchlist Internet: How to unmask telltale links (opens in a new tab)Displaying links with a mouse and smartphone, suspicious addresses, reporting form
- Watchlist Internet: When a deepfake calls instead of the executive floor (opens in a new tab)CEO fraud, identifying features, my company is affected
- Microsoft Learn: Report phishing and suspicious emails in Outlook (opens in a new tab)Built-in button in Outlook; accessed October 25, 2026
- Microsoft Learn: How to protect yourself against phishing attacks (opens in a new tab)Signs of a phishing scam, what to do
- Microsoft Support: Tech support scams (opens in a new tab)How scammers operate, how to protect yourself
- CISA, NSA, FBI, MS-ISAC: Phishing Guidance – Stopping the Attack Cycle at Phase One (opens in a new tab)PDF pp. 4 to 6 (techniques, MFA, DMARC, training), p. 12 (reporting)
This cheat sheet provides an overview and does not replace your company's rules. Enter your internal reporting channels in the template before sharing it. Names and functions in Outlook may differ depending on the version and your IT's settings; contact details of the reporting offices as of October 25, 2026.
TOOLBOX
Explore
Further.
- Kostenlos
Email security check (German)
Check SPF, DKIM, DMARC
Check Now Phishing in the Glossary
How phishing works, typical examples, and what companies should watch out for.
Learn MoreBusiness Email Compromise
Fraud via spoofed or compromised business mailboxes, with examples and protective measures for payments.
Learn MoreSocial Engineering
The psychological levers behind phishing, CEO fraud, and phone scams, briefly explained.
Learn More
SECURITY BASICS
More on
This Topic.
- PDF
Password Policy
Length instead of mandatory special characters, changes only on suspicion, blocklist, and MFA: a password policy to adapt, with an old-versus-new comparison and a checklist for Microsoft Entra ID.
View - PDF
IT Security Policy
Model text with placeholders for the information security policy and eight basic rules for all employees, aligned with BSI IT-Grundschutz, the NISG 2026, and the NISV 2026.
View - PDF
Patch Management Checklist
Updates by risk instead of by calendar: inventory, prioritization by exploited vulnerabilities, deadlines per risk level, roles, exceptions and evidence. Based on BSI, NIST, CISA and the NISV 2026.
View
YOUR NEXT STEP
From Paper
to Practice.
We review with you what is already implemented in your environment and put the rest into practice: as a project with EXPERTS or as ongoing operations with GRID.