Phishing Checklist (Printable)

Phishing Checklist

Interactive Security Resource

VER 1.2

1 Quick Decision (10s)

Was I expecting this? If no → treat as suspicious. Is it urgent/threatening? If yes → slow down. Asks for creds/payment? If yes → verify first.

2 Sender Verification

Check full email address (not just display name). Look for typos or odd domains (e.g. "rn" instead of "m" or support-google.com). If internal: confirm normal channel and tone.

3 Link Verification

Hover/Long-press to preview URL. Read domain carefully (rn vs m, .co vs .com). Avoid shortened links unless verified. Unsure? Don't click. Go to app manually.

4 Attachment Check

High risk: .zip, .html, .exe, .iso, .docm. Invoice/HR/Doc? Verify via second channel. Never enable macros unless 100% certain.

5 Content Red Flags

Generic greeting ("Dear User"). Bypasses process ("Just this once", "Confidential"). Payment details change without workflow.

6 High-Risk Scenarios

ALWAYS VERIFY:

Password reset / Security alert
Unsolicited MFA push
Invoice / Bank changes
Shared doc access
Urgent gift card / crypto

7 Safe Verification

Call via known number (not email signature). Message via Teams/Slack (new chat). Visit vendor site via bookmark.

8 If You Clicked...

Change password immediately. Revoke sessions / Sign out everywhere. Enable MFA (Authenticator app). Check for auto-forwarding rules. Contact IT/Security + Bank.

9. Reporting

Process: Use your organization’s “Report Phishing” option if available, or follow your standard reporting method (IT/Security/helpdesk).

Include: Sender, Time, Subject, and what action you took.