Tips To Identify Phishing E-mails and Fake Websites in 2022

Here are a few ways to figure out if an email or URL is legit. To identify fake email addresses.

End-users need to pay attention to what comes after the @ sign.

A legitimate email domain will match the URL for the organization’s website. A bad actor cannot replicate an organization’s domain without going through a registration process. That said, they can create a similar domain and put whatever they want on the sender’s name. 


As we rely more on backlinking, cookies, and search engines to reach websites, end-users tend to pay less attention to the URL in the address bar. But for safe browsing, make sure your connection is secure, that you’re using a secure browser, and that the URL makes sense.

Here’s an exercise IT pros can do to help end-users better identify fake domains. Create and spoof a few email addresses on free email clients and on your own email domain. If your customers email you from Gmail accounts, use that free service to make a few. Create your own fake or phishing but harmless websites and send them to your own employees. Tag those emails to a tool that tracks open rates and clicks.


Monitor the activity to see who accessed the link. Anyone that clicked on it needs to be trained that it is unsafe to open a suspicious link from an email. Not only do we have to pay attention to domains and email addresses, but we also have to scan the body of the email to see if there is anything strange and suspicious.

The end game of a phishing attempt can either be ransomware or malware or possibly both. To reduce security risks, allow your end-users to think critically about what is being asked of them and take action.

Here are a few characteristics of phishing emails. Urgency is the reddest of all red flags. 

Any email that says, “Login immediately”, “Click here now”, or “Action Required” is bogus. Anything asking for a wire transfer or checking upon payment receipt, attachments with edited file names, uncharacteristic language, multiple links in the email, asking to forward the request.


Be suspicious of any emails asking you to forward the message to anyone in your organization, regardless of the tenure or title requested. And here’s an exercise IT pros can do to help end-users recognize phishing emails.

Draft emails containing one or all of the features stated before and send them out from both your own legitimate email address and from a dummy account that you’re using for the purposes of this training.


Hopefully, the open rates will be nonexistent on the dummy account. For the emails coming from your domain, make sure they are following protocol by over-communicating before opening.