This is an old revision of the document!

CLNT - EMAIL - SEC - How to check if an email is legit or phishing
Quick Email Legitimacy Checklist (For All Incoming Emails)
0) Hard Stops — If any are true, **stop** and report
1) Expectation Check (first, 10 seconds)
2) Sender Check
3) Link Safety
4) Attachments
5) Language & Look
6) Mail Client Warnings
7) Verify Safely (never via email links)
8) If Suspicious
9) One-Minute Flow (print-friendly)
Notes for Admins (optional)

see last modified date at base of all pages

CLNT - EMAIL - SEC - How to check if an email is legit or phishing

Sir David — here’s a clean DocuWiki edit-page version tailored for all incoming emails (includes your two “Am I expecting…” checks). Paste directly into your wiki.

```

Quick Email Legitimacy Checklist (For All Incoming Emails)

Audience: End users.\ Purpose: 60-second decision guide for any email you receive.\ Last updated: @@2025-10-17@@

0) Hard Stops — If any are true, stop and report

Asks for passwords, 2FA codes, remote access, or confidential data.
Urgent payment / bank change / gift cards / crypto.
You were not expecting this email or request.

1) Expectation Check (first, 10 seconds)

Am I expecting anything right now?
Am I expecting anything from these people/company?
Do I actually have an account or relationship with the named company?

If No to any → treat as suspicious and go to 8) If Suspicious.

2) Sender Check

Display name matches someone you know or a real department.
Email address uses the real domain (no look-alikes like `rnicrosoft.com`, no extra words).
Reply-To matches the From address (no domain switch).

3) Link Safety

Hover links: target stays on the brand’s real domain (e.g. `https://accounts.google.com/…`, not `https://google.secure-login.example.com/…`).
No link shorteners (bit.ly, tinyurl) or random strings.
Avoid scanning QR codes from emails.

4) Attachments

You were expecting an attachment from this sender.
Block risky types: `.exe .js .scr .bat .ps1 .vbs .iso .img .zip .html .htm`
Office/PDF should not ask to “Enable Content/Macros”.

5) Language & Look

Uses your correct name and specific details you recognise.
No threats, pressure, giveaways, or too-good-to-be-true offers.
Branding looks normal (not blurry; footer/legal details look standard).

6) Mail Client Warnings

No “External Sender” or “SPF/DKIM/DMARC failed” banners.
Not auto-flagged as suspicious by your mail client.

7) Verify Safely (never via email links)

Open the website/app yourself from a saved bookmark or by typing the address.
Call/message the sender using a known number/channel (not the email’s number/link).
For payment/bank-detail changes: perform a voice check with your contact.

8) If Suspicious

Do not click. Do not reply. Do not forward (except to IT/security).
Use “Report phishing” in your mail app, then delete.
If you clicked or entered details: change password, enable MFA, notify IT/bank, run a malware scan.
Optional: forward a copy to reportphishing@apwg.org or report at Scamwatch (ACCC).

9) One-Minute Flow (print-friendly)

Expecting? → From these people? → Account exists?\
Check From + Reply-To domain → Hover every link → Attachment type safe?\
Read tone/grammar/branding → Client banners OK?\
Verify via bookmark/known number → If doubt, report and delete.

Notes for Admins (optional)

Add your internal report address here: security@yourdomain.tld\
Add your policy page link here: Email Security Policy\
Train users to screenshot headers when reporting.

```

SC-Wiki24

Table of Contents

CLNT - EMAIL - SEC - How to check if an email is legit or phishing

Quick Email Legitimacy Checklist (For All Incoming Emails)

0) Hard Stops — If any are true, stop and report

1) Expectation Check (first, 10 seconds)

2) Sender Check

3) Link Safety

4) Attachments

5) Language & Look

6) Mail Client Warnings

7) Verify Safely (never via email links)

8) If Suspicious

9) One-Minute Flow (print-friendly)

Notes for Admins (optional)

Table of Contents

CLNT - EMAIL - SEC - How to check if an email is legit or phishing

Quick Email Legitimacy Checklist (For All Incoming Emails)

0) Hard Stops — If any are true, **stop** and report

1) Expectation Check (first, 10 seconds)

2) Sender Check

3) Link Safety

4) Attachments

5) Language & Look

6) Mail Client Warnings

7) Verify Safely (never via email links)

8) If Suspicious

9) One-Minute Flow (print-friendly)

Notes for Admins (optional)

0) Hard Stops — If any are true, stop and report