You get a message from "your bank" asking you to confirm your details urgently. Or an invoice from a supplier with a new IBAN. Or a warning that your mailbox is full and will be blocked today. It looks real, but it may be phishing: a fake email designed to steal passwords, bank details or money.
In small businesses, a single careless click can cause serious damage. The good news is that most of these emails have signs you can spot in a few seconds, as long as you know where to look.
1. The sender and recipients don't add up
Don't just look at the name shown: look at the full address. An email from "Millennium" (a Portuguese bank) sent from millenium-apoio@gmail.com, or from "CTT" (the Portuguese postal service) sent from ctt-entregas.info, is fake. Also be wary of domains that are almost identical to the real one, with one letter swapped or added, such as aiod0.pt instead of aiodo.pt. And remember that many organisations don't even send this kind of message by email: when in doubt, check on their official website which addresses they use.
Also check where the reply goes. When you click "Reply", the address in the "To" field should be the same as the sender's. If the email claims to come from your supplier but the reply goes to a different address (the so-called reply-to), it is a classic sign of fraud, especially in payment requests.
Finally, look at who it was sent to. A notice about "your account" or "your invoice" should be for you alone. If it was sent to dozens of visible recipients, or shows "Undisclosed recipients" in the "To" field, it was sent in bulk and is not a personal message.
Tip: on your phone, tap the sender's name to see the real address.
Advanced tip: some email programs show a "List-ID" field in the message details. It means the email was sent to a distribution list, like a newsletter. That is normal for a newsletter, but if the message looks personal, such as an invoice or an account notice, be suspicious.
2. It's in a hurry or makes threats
"Your account will be suspended in 24 hours." "Final notice." "Overdue payment, avoid the fine." Urgency is the phisher's favourite weapon, because people in a hurry don't double-check. A bank, the tax authority or a serious supplier won't force you to sort everything out in the next few minutes through a link.
3. The links go somewhere else
Before clicking, hover your mouse over the link (on a computer) or press and hold it (on your phone) to see the real address. If the text says portaldasfinancas.gov.pt (the Portuguese tax portal) but the link points to a strange address, don't click. When in doubt, type the website address into your browser yourself or use the official app.
4. It asks for data, codes or payments
No serious organisation will ask you by email for your password, the code you received by text message or your full card details.
Be extra careful with a very common case in businesses: an email from a "supplier" or "customer" saying they have changed their IBAN. Before paying, always confirm by phone, using a number you already had, and never the number in the email itself.
5. It has an attachment you weren't expecting
Invoices, orders, "scanned documents" or compressed files (.zip) you didn't ask for are a classic way of installing viruses. If you weren't expecting the attachment, don't open it: first contact the person who supposedly sent it and check.
What about spelling mistakes?
For years they were the easiest sign to spot. Today, with automatic translation and artificial intelligence, many fake emails are well written. Mistakes are still a warning sign, but correct text is no longer a guarantee of anything.
I clicked. What now?
It happens to the best of us. What matters is acting quickly:
- Change the password of the affected account and any others where you use the same one.
- If you gave out bank details, call your bank right away and ask them to block the card or the transaction.
- Turn on two-step verification for your email and most important accounts.
- Warn your team and contacts, especially if the email was sent from your account.
- Report the incident to CERT.PT, part of Portugal's National Cybersecurity Centre.
How to protect your business email
- Use a different password for each service and a password manager. To create strong passwords, you can use our password generator.
- Turn on two-step verification wherever possible.
- Use an email address on your company domain (name@yourcompany.pt) instead of free accounts: it builds trust and is easier to protect.
- Make sure your domain has SPF, DKIM and DMARC records set up: they help stop anyone from sending fake emails in your company's name. You can check in seconds with our email domain checker.
- Keep your computer and phone up to date.
- Talk about this with your team. Five minutes of conversation prevents a lot of problems.
Need help?
At aiodo we help small businesses get a professional website and business email, with their own domain and the right setup. If you have questions about the security of your company email, or received a suspicious message and don't know what to do, get in touch.
