Your CFO receives an email from DocuSign. Subject line: “Signature required: Invoice #F-2847.” The email is well formatted, the logo looks right and the tone is professional. She clicks “Review document” and enters her Microsoft 365 credentials on the page that appears.

Except the sender was docu-sign@notif-secure.com, not dce@docusign.net. The login page was hosted on microsft-login.com, not microsoft.com. And invoice #F-2847 doesn’t exist.

In France, 55% of significant cyberattacks on companies use phishing as the entry vector (CESIN Barometer, 2026). The median time between receiving a phishing email and clicking the link is 21 seconds (Verizon DBIR, 2024). Your employees don’t spend five minutes pondering suspicious emails. They click or they don’t, and the decision takes seconds.

This guide lists 9 concrete warning signs to spot a fraudulent email before clicking. Each sign comes with a real example from campaigns observed in France between 2024 and 2026. At the end you’ll find a simple procedure for when an email seems off, and a printable checklist for your teams.

The short version

In 2024, 74% of French companies were targeted by at least one phishing attempt (CESIN Barometer, 2025).
The median time between receiving a phishing email and clicking the link is 21 seconds (Verizon DBIR, 2024). People decide to click almost instantly.
An email’s display name is free-form and proves nothing. Only the sender’s full address matters, so always compare the domain after the @ with the organization’s official website.
Quishing (QR code phishing) grew by 400% between 2023 and 2025 according to ENISA, because anti-spam filters analyze QR codes less effectively than text links.
The average click rate on a phishing simulation is 33.1% before any training and 4.1% after 12 months of regular training (KnowBe4, Phishing By Industry Benchmarking Report 2025).

Sign 1: The sender’s address doesn’t match the organization

First reflex: look at the email address, not the display name.

An email can show “BNP Paribas Customer Service” as the sender name while actually coming from service-bnp@secure-notifications.com. Anyone can write whatever they want in the display name. Only the address matters.

Real examples observed in France:

“DocuSign” sent from docu-sign@notif-secure.com (the real DocuSign domain is docusign.net)
“Chronopost” sent from chronopost-livraison@suivi-colis.info (the real domain is chronopost.fr)
“Ameli” (France’s health insurance) sent from contact@assurance-maladie-remboursement.com (the real domain is ameli.fr)

To check, click the sender’s name to reveal the full address. On mobile, long-press the name. Compare the domain (the part after @) with the organization’s official website.

Watch for lookalike domains. Attackers register domains that resemble the real ones: arnazon.com instead of amazon.com, bnp-paribas.info instead of bnpparibas.com. Check every letter. The APWG counted more than 4.8 million active phishing sites worldwide, most using lookalike domains registered days before the attack (APWG, Phishing Activity Trends Report Q4 2024).

Sign 2: The link doesn’t point where it claims

Before clicking a link, hover over it without clicking. The destination URL appears in the bottom-left corner of your browser, or in a tooltip.

What to check:

Does the domain in the URL match the organization? A “View your EDF invoice” link pointing to edf-facture.serveur-web.ru has nothing to do with EDF (a major French energy provider).
Does the site use HTTPS? A padlock is no longer a reliable signal (attackers use HTTPS too), but a plain HTTP link on a banking or government site is suspicious.
Does the URL contain deceptive subdomains? For example, in bnpparibas.com.verification-compte.net the real domain is verification-compte.net. The domain is always the last part before the first ”/”.

A real example: a “Microsoft 365” email asks you to “Verify your account” with a button pointing to login.microsoftonline.com.auth-verify.net. The employee sees “microsoftonline.com” in the URL and thinks it’s legitimate. The real domain is auth-verify.net.

On mobile, long-press the link to display the URL without opening it. If you can’t verify the link, don’t click.

Is your team hesitating over an email? Instead of hunting for clues, they can forward it. nophi.sh analyzes the email and sends back a verdict with its reasons (phishing, suspicious, or legitimate), usually in under a minute.

Sign 3: A sense of urgency or threat

Phishing emails play on panic. If an email pushes you to act within minutes or face consequences, slow down.

Classic attacker phrases:

“Your account will be suspended in 24 hours”
“Immediate action required or penalties will apply”
“Suspicious login attempt detected: secure your account now”
“Unpaid invoice: final notice before legal action”

Legitimate services don’t impose a few-hour deadline for an administrative action. Your bank won’t suspend your account because you didn’t click a link within the hour. Government agencies don’t threaten to cancel your benefits by email.

Researchers describe the mechanism with Daniel Kahneman’s two modes of thinking: System 1, fast and instinctive, and System 2, slow and analytical. Artificial urgency keeps your brain in System 1, so you act without thinking (Vishwanath et al., Computers in Human Behavior, 2018).

The counter is simple: when an email pressures you, take 30 seconds to verify through another channel. Call the organization at their official number (not the one in the email). Go to the website by typing the address yourself in your browser.

Sign 4: A request for credentials or sensitive information

Legitimate services never ask for your password by email. That includes Microsoft, Google, your bank, the tax office and your energy provider.

If an email redirects you to a login page, check the URL of that page before entering anything. And ask yourself: was I expecting this email? Did I initiate this action?

Common suspicious requests:

“Confirm your password to maintain access to your account”
“Update your bank details to receive your refund”
“Enter your card number to release your package”

The CNIL (France’s data protection authority) states that “public authorities and reputable companies never request sensitive data (passwords, bank details) by email or SMS” (CNIL, phishing recommendations, 2024).

Sign 5: Unusual mistakes or an off tone

Phishing emails in 2020 were riddled with obvious spelling errors. In 2026, attackers use AI writing tools, and their emails are often grammatically flawless.

So look for tone mismatches rather than glaring errors.

What should raise a flag:

An unusually formal tone from someone you know casually (your boss suddenly using formal language when they usually don’t)
Phrasing that doesn’t match the organization’s usual style (“Dear valued customer”)
A mix of languages or typographic conventions (British punctuation in an email supposedly from a US company)
Unusual capitals or excessive punctuation (“URGENT!!! Your parcel is WAITING!!!”)

Sign 6: An unexpected attachment

You weren’t expecting an invoice? You didn’t request a document? The attachment is probably booby-trapped.

File types to handle with caution:

.exe, .scr, .bat, .cmd: executables. Never open these from an email.
.zip, .rar, .7z containing an executable: attackers compress malicious files to get past filters.
.docm, .xlsm: Office files with macros. Macros can run code on your machine.
.pdf: PDFs can contain malicious links or exploit vulnerabilities in the PDF reader. An unexpected PDF deserves verification.
.html: an HTML attachment is almost always a phishing attempt. It displays a fake login page directly on your machine, without going through a remote server, so network filters don’t see it.

The rule: if you weren’t expecting the attachment, don’t open it. Contact the sender through another channel to confirm they sent it.

Cybermalveillance.gouv.fr (France’s national cybercrime assistance platform) recommends “never opening attachments from a doubtful message, as some contain viruses” and “verifying the plausibility of the message by directly contacting the organization involved” (Cybermalveillance.gouv.fr, phishing response guide, 2025).

Sign 7: You’re not the logical recipient

You receive an urgent wire transfer request from the CEO, but you work in tech support. HR sends you a “health insurance update” even though you left that plan six months ago. Accounting receives an invoice from a vendor that works only with procurement.

Attackers don’t know your company’s org chart. They send to broad lists hoping someone will bite. If the email doesn’t logically concern you, treat that as a signal.

CEO fraud is a special case. The email appears to come from your CEO and requests an urgent, confidential wire transfer. In France, CEO fraud cost companies more than EUR 400 million between 2020 and 2024 (Office central pour la répression de la grande délinquance financière, France’s financial crime unit, 2024). These cases share urgency, confidentiality and a recipient who doesn’t dare check with management.

The rule is absolute: confirm any financial request received by email by phone, calling the usual number (never a number provided in the email).

Do your employees spot these signs under pressure? Reading this guide on a quiet afternoon is easy. Reacting correctly to a fake email in their inbox on a Tuesday morning is harder. Phishing simulations test your team’s real reflexes with realistic scenarios. Those who click get a 3-minute lesson on the mistake they just made.

Sign 8: The email contains a QR code

“Quishing” (QR code phishing) grew by 400% between 2023 and 2025 according to ENISA (European Union Agency for Cybersecurity, Threat Landscape 2025). Attackers embed QR codes in emails because anti-spam filters analyze them less effectively than text links.

Observed examples:

A “Microsoft 365” email asking you to scan a QR code to “reactivate two-factor authentication”
A fake invoice PDF containing a QR code “to view details online”
A “DHL” email with a QR code to “reschedule delivery”

The rule: never scan a QR code received by email. An organization that wants to send you to a page can use a standard link. A QR code in an email is almost always an attempt to get past security filters.

Sign 9: The offer is too good to be true

An unexpected refund from health insurance. A prize for a contest you never entered. An exceptional bonus from your employer. A free phone from your carrier.

If you didn’t ask for anything and something is being offered, the email is fraudulent. This sign seems obvious in the abstract, but it still works: campaigns using fake Ameli (French health insurance) refunds remain among the most effective in France according to Cybermalveillance.gouv.fr (annual report 2024).

What to do when an email seems suspicious

You’ve spotted one or more warning signs. Here’s what to do next.

1. Don’t click anything

Leave the links and attachments alone, including the “Unsubscribe” button. Even the unsubscribe link can be booby-trapped.

2. Don’t reply

Replying confirms to the attacker that your address is active and monitored. They’ll target you again.

3. Verify through another channel

If the email appears to come from a colleague, call them. If it claims to come from an organization, go to the official website by typing the address yourself (don’t copy the link from the email). Contact customer service at the usual number.

4. Forward the email for verification

If your company uses a verification service like nophi.sh, forward the suspicious email to the dedicated address (or use the Microsoft 365 Report button if it is set up to send there). The AI analyzes the sender, links, headers and attachments, and sends back a verdict (confirmed phishing, suspicious, or legitimate), usually in under a minute. The employee gets an explanation of the signals it found, so each check teaches them something.

5. Report the email

Use the “Report as phishing” button in your email client (available in Gmail, Outlook and most modern clients). If your company has an internal reporting process, follow it. Every report helps the security team protect other employees.

6. If you already clicked

If you’ve already clicked a link or entered information, see our incident response guide. The first 15 minutes are decisive.

Printable checklist: the 9 warning signs at a glance

Post this list in common areas or send it to your teams.

#	Sign	Verification
1	Suspicious sender address	Click the name to reveal the full address. Compare the domain with the official website.
2	Questionable link	Hover over the link without clicking. Check that the domain matches.
3	Urgency or threat	Ask yourself: does this organization usually send me this type of message? Verify by phone.
4	Request for credentials	Never enter a password from a link received by email. Go directly to the official site.
5	Off tone	Compare with usual emails from this sender.
6	Unexpected attachment	Don’t open it. Contact the sender through another channel.
7	Illogical recipient	Ask yourself: does this request actually concern me?
8	QR code in an email	Never scan it. Legitimate organizations use links.
9	Too-good-to-be-true offer	If you didn’t ask for anything, it’s fake.

The gap between knowing and doing

Your employees probably already know most of these warning signs. What fails is behavior under pressure. An employee reading this guide on a calm Tuesday morning will spot a fraudulent email. The same employee on a Friday at 5 PM with three urgent projects will click on the fake DocuSign without checking the sender’s address.

Written guides are not enough on their own. Anti-phishing training works through repeated practice: regular simulations that test reflexes under real working conditions, followed by immediate feedback when an employee makes a mistake.

KnowBe4 measured an average click rate of 33.1% on phishing simulations before any training, falling to 4.1% after 12 months of regular training (Phishing By Industry Benchmarking Report 2025, based on 67.7 million simulations).

Test your team’s reflexes. Start a 14-day free trial: about 15 minutes of setup (plus allow-listing with your email provider) and your first campaign can go out the same day. You need neither a credit card nor any installation.

Sources

CESIN, Baromètre de la cybersécurité des entreprises, 2025 and 2026 editions
Verizon, Data Breach Investigations Report 2024
APWG, Phishing Activity Trends Report Q4 2024
ENISA, Threat Landscape 2025
CNIL (France’s data protection authority), phishing recommendations, 2024
Cybermalveillance.gouv.fr (France’s national cybercrime assistance platform), phishing response guide, 2025
Cybermalveillance.gouv.fr, annual report 2024
ANSSI (France’s national cybersecurity agency, cyber.gouv.fr), digital security best practices
KnowBe4, Phishing By Industry Benchmarking Report 2025
Office central pour la répression de la grande délinquance financière (France’s financial crime unit), 2024
Vishwanath A. et al., “Suspicion, Cognition, and Automaticity Model of Phishing Susceptibility,” Computers in Human Behavior, 2018

Launch your first phishing simulation | What to do if an employee clicked