Nearly every incident our SOC is called into begins the same way: a single email that looked close enough to real. Attackers do not need to break your firewall if they can convince one member of staff to hand over a password. The good news is that phishing relies on the same handful of tricks, and once a team can name them, the click rate drops fast.
1. The address is almost right
Display names are free to fake. Hover the sender and read the actual domain — info@velpiont.com is not info@velpoint.com. Attackers register look-alike domains that swap letters, add a word, or use a different country suffix.
2. It manufactures urgency
"Your account will be closed in 24 hours." "Approve this payment now or the shipment stops." Urgency is designed to stop you thinking. A real supplier or bank will still be there after you have called them on a number you already had.
3. The link and the text disagree
The email says portal.yourbank.lk but hovering shows a shortened link or an unfamiliar domain. On a phone, press and hold the link to preview where it really goes before you tap.
4. It asks for something an email never should
No legitimate service emails you to "confirm your password" or type your OTP into a form. Credentials go into a site you navigated to yourself, never into a link someone sent you.
5. The payment details just changed
Invoice fraud is the most expensive phishing we see in Sri Lanka. A supplier you know emails a real-looking invoice with new bank details. Always confirm a change of account by phone, using a number from a previous contact — not the one on the new invoice.
6. It is oddly generic — or oddly specific
"Dear customer" from a company that knows your name is a flag. So is a message that quotes real details lifted from LinkedIn to earn your trust. Both are signs someone is working from a script, not writing to you.
7. Something just feels off
Train your team to trust that instinct and give them a safe way to act on it: a single address to forward a suspicious email to, and a firm rule that no one is ever in trouble for checking. The cost of a false alarm is a minute; the cost of a real one is your week.
What to do when someone clicks anyway
People will click. Assume it and plan for it: change the password immediately, enable multi-factor authentication if it was not already on, and tell your IT contact so they can watch the account. If money moved, contact your bank within the hour — the first sixty minutes decide whether it can be recalled.