Module 2 of StartCloud's Cyber Hygiene for Staff learning pathway, in six short units with a knowledge check: why phishing works on busy people (urgency, authority, familiarity), the red flags in a suspicious email walked through on a mock example, scam texts, calls and QR codes, business email compromise and the verify-by-phone golden rule, and the two-second habits that beat most of it.
How to Spot a Phishing Email Before You Click
Why phishing still works
First, a reframe. Phishing does not work because people are gullible. It works because people are busy. It is a numbers game: send a convincing fake to enough inboxes and a handful of people, mid-meeting, mid-deadline, mid-school-pickup-panic, will click before they think. The scammer does not need you to be careless all day. They need two careless seconds.
That is also why phishing sits year after year among the most commonly reported cybercrimes for Australian businesses. Not because it is clever. Because it scales, and because it is aimed at the one thing every workplace has plenty of: people with too much to do.
Nearly every phishing message, on any channel, pulls on the same three levers. Learn to feel the tug and you are most of the way there.
Your account will be suspended in 24 hours. Your parcel will be returned today. The invoice is overdue and the matter is escalating. Deadlines switch off the careful part of your brain, which is exactly the point.
We are wired to respond quickly to people and institutions with power over us. A message that appears to come from your bank, the tax office, or your own managing director gets opened faster and questioned less.
Microsoft 365, Australia Post, myGov, your bank. The logos are copied, the layout is copied, and your eye has seen the real thing a thousand times, so it fills in the gaps and vouches for the fake.
Here is the trick the rest of this module builds on: the moment a message makes you feel rushed, leaned on, or flattered, that feeling is your cue to slow down, not speed up. Real organisations almost never need you to do anything in the next ten minutes. Scammers almost always do.