← All guides

Staff guide

How to spot a phishing email

3 min read

Most attacks on small practices start with one email. These checks take seconds and catch most of them.

Example: a phishing email (not real)
From"EHR Support" <support@ehr-portal-alerts.example>
SubjectAction required: your password expires today
Your password expires in 2 hours. Click below to keep your account active.
Update Password
  • The sender's domain is not your EHR vendor's real domain.
  • It rushes you: "expires in 2 hours."
  • It does not use your name.
  • The button leads somewhere other than the real login page.

Five checks before you click

  1. Sender. Look at the actual email address, not just the name.
  2. Urgency. "Today," "immediately," and "final notice" are pressure tactics.
  3. Links. Hover over a link to see where it really goes.
  4. Requests. Be wary of any request for a password, payment, or gift cards.
  5. Surprise. Unexpected invoices or attachments deserve a phone call first.

If you already clicked

Do not panic, and do not hide it. Tell your manager right away, change the password you entered, and let your IT support know. Speed matters more than blame.

How our phishing training works →

Questions? Talk to us, or start with a free exposure check.