Recognizing Phishing: Cheat Sheet for Employees

• PausePressure is the warning sign

  Urgent calls to action and threatened consequences are typical features (BSI, Federal Criminal Police Office).

• CheckThrough another channel

  Not via the link or number in the message, but via contact details you look up yourself (BSI).

• ReportIncluding your own click

  Also report suspicious emails, links, and attachments you have opened, as early as possible (CISA).

Phishing messages pretend to come from a known person or organization, such as a bank, a parcel service, a public authority, a manager, or the IT department. They aim to get you to open a link, launch an attachment, enter credentials, or transfer money (BSI, CISA). Error-free text is no proof of authenticity: according to the BSI, typos are now only rarely a clear indication. Pay attention to the request, not the language.

One feature is enough to be suspicious. The BSI lists urgent calls to action, threats, requests for confidential data, links or forms, and unusual requests from known senders: if at least one applies, it is very likely phishing.

• The message arrives unexpectedly, for example from someone you rarely deal with (Microsoft).
• The “To” field contains many seemingly random recipients (Microsoft).
• The greeting is impersonal, such as “Dear customer” (Federal Criminal Police Office).

1. 1

   Pause

   Don't reply, click, or pay right away. Urgency and threats are typical features of phishing (BSI).

2. 2

   Look at the sender

   Move the mouse pointer over the sender line without clicking: is there a different address behind the name (BSI)? Odd spellings, numbers, or additions (Federal Criminal Police Office)?

3. 3

   Check the link target, don't click

   Hover over the link, or press and hold it on a smartphone. An address is suspicious if it does not belong to the supposed organization, only imitates its name, or is a short link (Watchlist Internet, BSI).

4. 4

   Go there yourself instead of clicking

   Open the sender's website or app via a bookmark or the known address instead of following the link (Federal Criminal Police Office).

5. 5

   Ask back through a known channel

   Call, but using a number you looked up yourself, not the one in the message (BSI). This also applies to managers (Watchlist Internet).

6. 6

   Report if in doubt

   Don't respond; report it through the internal reporting channel instead. That way, IT can warn others too (Watchlist Internet).

Reporting is not an admission of guilt: the sooner IT knows, the sooner accounts can be blocked and others warned. The table is a TOMORIS recommendation; your company's rules take precedence.

• Internal first: through your company's reporting channel, usually IT or the help desk. Microsoft recommends reporting threats to the security team immediately.
• Outlook: select the message, choose the built-in report button (“Report”), then “Report phishing.” The message is deleted and, depending on the settings, sent to a reporting mailbox, to Microsoft, or to both; the button only appears in supported Outlook versions if your organization has set up the reporting feature (Microsoft Learn).
• Watchlist Internet: report phishing and other online traps using the reporting form on watchlist-internet.at; this helps protect others.
• Cybercrime reporting office of the Federal Criminal Police Office: against-cybercrime@bmi.gv.at if you suspect fraud. The report does not replace a criminal complaint; if damage has occurred, file a report with the police (Federal Criminal Police Office).
• Companies after a cyberattack: Cyber Security Hotline of the Austrian Economic Chamber (Wirtschaftskammer Österreich), 0800 888 133 (Federal Criminal Police Office).

• Am I expecting this message, and does the request fit the sender?
• Is the actual sender address correct, not just the displayed name?
• Am I being put under time pressure or threatened? Then check all the more.
• Does the link really lead to the organization that is writing? Hover over it, don't click.
• Am I supposed to open an attachment, enable macros, or install something? Ask first.
• Is a password, PIN, TAN, or one-time code being requested? Don't enter anything.
• Am I supposed to scan a QR code from an email? Don't scan it.
• An MFA request although I'm not signing in? Deny it and report it.
• Am I supposed to transfer money or change bank details? Ask first through a known channel.
• Supposed IT support wants remote access? Hang up and call your own IT.

TOMORIS recommendations; check legal obligations, for example under the NISG 2026 (Austrian Network and Information Systems Security Act 2026), separately.

• Define the reporting channel and make it known; in Microsoft 365, enable the Outlook report button and define a reporting mailbox (Microsoft Learn).
• Train regularly: recognize suspicious emails and links, don't respond to them, and report opening them too (CISA). Welcome reports, including false alarms.
• Secure payments: whoever approves payments checks senders carefully and confirms unusual payment instructions through another communication channel (Watchlist Internet).
• Harden sign-in: phishing-resistant MFA based on FIDO or PKI; where that is not possible, push notifications with number matching (CISA).
• Protect your own domain: set DMARC for outgoing email to reject so that spoofed senders from your domain are rejected (CISA). The free email security check shows whether SPF, DKIM, and DMARC are set.