10 Tips to Spot a Phishing Email & Photoshopped Email Scams
I’ve been in cybersecurity long enough — as far back as when Slammer was doing its thing — to understand that some threats never die, they just morph. Phishing is one of those. Every year, it gets trickier. Smarter attackers. More convincing emails. And don’t get me started on AI-generated phishing scams (yes, this is an actual thing now). I recently returned from DefCon, where I spent a bit too much time in the hardware hacking village, and even there phishing came up a lot; social engineering is timeless.
What is a Phishing Email?
What are Phishing Emails: Phishing emails are scam emails that are meant to deceive you into:
- Click on a malicious link
- Clicking on an attachment infected with malware
- Handing over your login details (or worse, financial info)
The goal? For identity theft, injecting malware or compromising an enterprise network. And it’s not just the obvious scams anymore — sometimes they’re perfect-looking. I’ve watched as banks were hammered with phishing attacks that had specific transaction details, real customer names, even internal jargon. Attackers do their research. So should we.
Red Flags to Watch For
Trying to avoid being phished? Here’s what to watch out for:
1. Suspicious Senders
Does an email that looks like it came from your bank actually look like it came from your bank? Or your CEO?, which might be example.com instead of the real @pjnetworks.com), that’s a red flag.
I’ve had cybercriminals impersonate my very own email — one letter off. That’s all it takes.
2. Urgency & Fear Tactics
- “Your account has been locked! Login now to regain access.”
- “We detected unusual activity — verify your information NOW.”
- “Last warning before suspension.”
Scammers want you to panic. The second you start to feel hurried, pause. Pause and make sure you validate before you click on anything.
3. Bizarre Grammar & Spelling Mistakes
Sometimes hackers get lazy — and their emails have typos that even an intern wouldn’t make. But here’s the catch: Even decent phishing emails may bungle their formatting in subtle ways (random font switches, wonky spacing). If it seems “off,” trust your gut.
4. Attachments and Links that Raise Suspicion
- Non-matching website links (hover before clicking!)
- Unanticipated attachments (esp. exe,. zip, or .html files)
- Longer URLs (paypal-secure-verification.com instead of paypal.com)
I once saw an employee get duped by a perfectly legitimate-looking invoice — except that the PDF had hidden malware embedded in it.
5. Requests for Login Info
Never give out your password through email — banks, companies and IT teams will never ask you for it. If they ever found out, it would either be a scam or it is time to get a new IT team.
What To Do If Targeted By Phishing Attacks
So what do you do if (you spot or fall for) a phishing email? Here’s what to do:
If you haven’t yet clicked on anything:
- Report it — Send the email to your IT/security team.
- Block the sender – Stop receiving emails from the same address.
- Mark it as spam — This tells spam filters it is spam.
If you hit the link but didn’t fill anything out:
- Close the tab immediately.
- Do an antivirus/malware scan (for good measure).
- Alert your IT department—they can protect the entire network if they know about the issue early on.
Enter your credentials (or downloaded something):
- Disconnect from the network – If you did download a file, unplug immediately to stout malware spread.
- Change your password, immediately — And turn on MFA. If it’s already on, update your recovery options just in case.
- Alert your IT/security team – They should keep an eye out for suspicious activity.
Phishing Prevention Solutions For PJ Networks
I’ve been in this field long enough to realize that awareness is the best defense. And this is the reason at PJ Networks we concentrate on:
1. Security Awareness Training
Your biggest risk? Your employees. We train teams to identify phishing attacks — before they occur.
2. AI-Based Phishing Protection
Yes, I realize I said I’m wary of “AI-powered security,” but this is useful. Phishing detection tools now use advanced algorithms to analyze patterns, behaviors, and even writing styles so that scams can be blocked before making it to your inbox.
3. Incident Response Planning
No matter how well someone is trained, eventually someone is going to click something. Good response planning leads to containment before a breach becomes a catastrophe.
Quick Take: STOP PHISHING in 4 EASY Steps
- — Every email is a trap — until proven otherwise.
- Trust but verify—especially when it comes to requests for credentials or payments.
- Enable multi-factor authentication (MFA) — so that if your password is stolen, you’re stopping hackers.
- Educate your employees — Human error is the greatest vulnerability in cybersecurity.
- Use phishing protection tools — if your spam filter isn’t getting rid of scams, it’s time to upgrade.
Conclusion
And phishing attacks are not going anywhere. If anything, they’re improving — more sophisticated, more personalized and harder to detect. But with a little damn common sense — good security habits and a healthy dose of paranoia — you can stay out of trouble.
And if your business needs help preventing, detecting or responding to phishing—PJ Networks can help. Because nothing spoils a Monday morning like learning your credentials were pilfered over the weekend.