What do I do if I receive a suspicious email?
If an email pressures you to act right now, asks for your password, or comes from an address you do not recognize, treat it as phishing: do not click, do not reply, and report it. Nothing bad happens if you ignore a real email for an hour. A lot can happen if you enter your password on a fake page.
How do I recognize a phishing email?
One of these signs is enough to be careful. Two or more means it is almost certainly a scam.
| Sign | What it looks like |
|---|---|
| Urgency | "Your account expires today", "Action required within 24 hours", "Your authentication has expired" |
| Asks for credentials | A link to "verify", "re-authenticate" or "unlock" your account. Real services never ask you to enter your password from an email link. |
| Sender does not match | The display name says a colleague or a known company, but the email address behind it is a different domain, often with small typos. |
| Unexpected attachment | An invoice, a voicemail, a shared document you were not expecting, especially as a ZIP or HTML file. |
| Odd link | The link text says one website, but hovering over it shows a completely different address, often a long random one. |
| Money or gift cards | A request to pay an invoice, change bank details, or buy gift cards, usually "from" someone senior in your company. |
Your company's email protection flags many of these messages automatically. In Gmail, unverified senders get a question mark next to their name. In Outlook, suspicious mail lands in the Junk folder or shows a warning banner. A warning banner is a strong signal, but a clean inbox does not guarantee a message is safe.
What do I do with the email?
- Do not click any link or open any attachment. Do not reply either, even to say "this is spam". A reply confirms your address is active.
- Check with the sender through another channel. If the email claims to be from a colleague or a supplier, call them or message them in Slack or Teams. Do not use the contact details from the email itself.
- Report it. Forward the email as an attachment to your IT admin or to hello@deeploi.io so the sender can be blocked for everyone in your company. To forward as an attachment in Outlook, select the email and choose ⋯ → Forward → Forward as attachment (on Windows also Ctrl + Alt + F). In Gmail, open the email and choose ⋮ → Forward as attachment. Then also mark it in your inbox: in Outlook use Report → Report phishing; in Gmail use ⋮ → Report phishing.
- Delete it. Once reported, delete the message. If it is in your Junk folder already, you can leave it there.
What if I already clicked or entered my password?
Act within minutes, not hours. Attackers use stolen passwords fast.
- Change the password of the account you entered, right away, from a page you open yourself (not from the email). If you use that password anywhere else, change it there too.
- Sign out everywhere. In Microsoft 365, open myaccount.microsoft.com, go to Security info, and choose Sign out everywhere. In Google, open myaccount.google.com/security and sign out of devices you do not recognize.
- Tell your IT admin or hello@deeploi.io immediately, even if you only clicked the link and did not enter anything. The earlier the team knows, the less damage a compromised account can do. Nobody will blame you for reporting.
- Watch your inbox. For the next days, look out for password-reset emails you did not request or for emails sent from your address that you did not write.
If your company uses deeploi Security+, known phishing websites are blocked before the page loads. That stops many attacks, but not new ones, so the steps above still apply.
Two-factor authentication (2FA) is your safety net: even with your password, an attacker cannot sign in without your second factor. If your company has not turned it on for you yet, see how to set up two-factor authentication for Microsoft 365 in 1Password.