{"id":248452,"date":"2026-10-30T00:00:17","date_gmt":"2026-10-30T00:00:17","guid":{"rendered":"https:\/\/logmeonce.com\/resources\/how-to-prevent-email-phishing\/"},"modified":"2026-10-30T00:00:18","modified_gmt":"2026-10-30T00:00:18","slug":"how-to-prevent-email-phishing","status":"publish","type":"post","link":"https:\/\/logmeonce.com\/resources\/how-to-prevent-email-phishing\/","title":{"rendered":"How to Prevent Email Phishing: A Practical Guide for 2026"},"content":{"rendered":"<div class=\"336cb5b64765e27a1a6c1bb71b941f1a\" data-index=\"1\" style=\"float: none; margin:10px 0 10px 0; text-align:center;\">\n<script async src=\"https:\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-4830628043307652\"\r\n     crossorigin=\"anonymous\"><\/script>\r\n<!-- above content -->\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block\"\r\n     data-ad-client=\"ca-pub-4830628043307652\"\r\n     data-ad-slot=\"5864845439\"\r\n     data-ad-format=\"auto\"\r\n     data-full-width-responsive=\"true\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script>\n<\/div>\n<\/p>\n<p>You prevent email phishing with three layers working together: a habit of pausing before you act on any message, account protections such as multi-factor authentication and a password manager, and, for organizations, technical controls like email filtering and DMARC. No single layer is enough. Filters miss messages, and people get tired or rushed. This guide covers each layer, shows how to spot a bad message, and explains what to do in the first hour if you already clicked.<\/p>\n<div data-blg-cta=\"after_tldr\" data-blg-cta-layout=\"banner\" style=\"margin:28px 0;font-family:-apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif\">\n<div style=\"border-radius:26px;padding:min(22px,3.2vw)\">\n<div style=\"background:#ffffff;border-radius:18px;overflow:hidden\">\n<div style=\"padding:34px 30px;text-align:center\">\n<div style=\"margin:0 0 18px\"><span style=\"max-width:100%;border-radius:999px;padding:6px 13px;font-size:12px;font-weight:800;letter-spacing:0.1em;text-transform:uppercase;line-height:1.3;background:#F47F24;color:#ffffff\">Logmeonce<\/span><\/div>\n<div style=\"font-size:26px;font-weight:800;line-height:1.2;letter-spacing:-0.01em;color:#1f2937;margin:0\">Strengthen Your Account Against Phishing<\/div>\n<div style=\"width:56px;height:6px;border-radius:3px;background:#F47F24;margin:12px 0 14px;margin-left:auto;margin-right:auto\"><\/div>\n<div style=\"font-size:15px;line-height:1.55;color:#64748b;margin:0 0 24px;max-width:44em;margin-left:auto;margin-right:auto\">LogMeOnce offers password management and multi-factor authentication to help protect accounts from phishing-related credential theft.<\/div>\n<p><a href=\"https:\/\/logmeonce.com\/resources\" style=\"align-items:center;gap:9px;border-radius:10px;font-weight:700;font-size:15px;text-decoration:none;padding:13px 22px 13px 26px;background:#F47F24;color:#ffffff\">Explore security resources<\/a><\/div>\n<\/div>\n<\/div>\n<\/div>\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_77 counter-hierarchy ez-toc-counter ez-toc-grey ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<span class=\"ez-toc-title-toggle\"><a href=\"#\" class=\"ez-toc-pull-right ez-toc-btn ez-toc-btn-xs ez-toc-btn-default ez-toc-toggle\" aria-label=\"Toggle Table of Content\"><span class=\"ez-toc-js-icon-con\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #999;color:#999\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #999;color:#999\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/span><\/a><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/logmeonce.com\/resources\/how-to-prevent-email-phishing\/#TLDR\" >TL;DR<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/logmeonce.com\/resources\/how-to-prevent-email-phishing\/#Why_phishing_still_works\" >Why phishing still works<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/logmeonce.com\/resources\/how-to-prevent-email-phishing\/#Layer_one_how_to_recognize_a_phishing_email\" >Layer one: how to recognize a phishing email<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/logmeonce.com\/resources\/how-to-prevent-email-phishing\/#The_red_flags\" >The red flags<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/logmeonce.com\/resources\/how-to-prevent-email-phishing\/#A_10-second_check_before_you_click\" >A 10-second check before you click<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/logmeonce.com\/resources\/how-to-prevent-email-phishing\/#What_to_do_with_a_suspicious_message\" >What to do with a suspicious message<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/logmeonce.com\/resources\/how-to-prevent-email-phishing\/#Layer_two_protect_your_accounts_and_devices\" >Layer two: protect your accounts and devices<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/logmeonce.com\/resources\/how-to-prevent-email-phishing\/#Turn_on_multi-factor_authentication\" >Turn on multi-factor authentication<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/logmeonce.com\/resources\/how-to-prevent-email-phishing\/#Use_unique_passwords_and_let_software_enter_them\" >Use unique passwords, and let software enter them<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-10\" href=\"https:\/\/logmeonce.com\/resources\/how-to-prevent-email-phishing\/#Keep_devices_and_backups_current\" >Keep devices and backups current<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-11\" href=\"https:\/\/logmeonce.com\/resources\/how-to-prevent-email-phishing\/#Limit_what_you_publish\" >Limit what you publish<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-12\" href=\"https:\/\/logmeonce.com\/resources\/how-to-prevent-email-phishing\/#Layer_three_how_organizations_reduce_phishing_risk\" >Layer three: how organizations reduce phishing risk<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-13\" href=\"https:\/\/logmeonce.com\/resources\/how-to-prevent-email-phishing\/#A_layered_checklist\" >A layered checklist<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-14\" href=\"https:\/\/logmeonce.com\/resources\/how-to-prevent-email-phishing\/#Training_that_works\" >Training that works<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-15\" href=\"https:\/\/logmeonce.com\/resources\/how-to-prevent-email-phishing\/#Handling_small-business_realities\" >Handling small-business realities<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-16\" href=\"https:\/\/logmeonce.com\/resources\/how-to-prevent-email-phishing\/#Our_perspective_where_phishing_defense_usually_breaks_down\" >Our perspective: where phishing defense usually breaks down<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-17\" href=\"https:\/\/logmeonce.com\/resources\/how-to-prevent-email-phishing\/#Tools_that_help_you_put_this_into_practice\" >Tools that help you put this into practice<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-18\" href=\"https:\/\/logmeonce.com\/resources\/how-to-prevent-email-phishing\/#If_you_already_clicked_the_first_hour\" >If you already clicked: the first hour<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-19\" href=\"https:\/\/logmeonce.com\/resources\/how-to-prevent-email-phishing\/#Common_mistakes_that_undo_good_defenses\" >Common mistakes that undo good defenses<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-20\" href=\"https:\/\/logmeonce.com\/resources\/how-to-prevent-email-phishing\/#FAQ\" >FAQ<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-21\" href=\"https:\/\/logmeonce.com\/resources\/how-to-prevent-email-phishing\/#How_can_I_stop_phishing_emails_from_reaching_my_inbox\" >How can I stop phishing emails from reaching my inbox?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-22\" href=\"https:\/\/logmeonce.com\/resources\/how-to-prevent-email-phishing\/#What_is_the_best_defense_against_phishing_emails\" >What is the best defense against phishing emails?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-23\" href=\"https:\/\/logmeonce.com\/resources\/how-to-prevent-email-phishing\/#How_do_I_stop_a_scammer_from_using_my_email\" >How do I stop a scammer from using my email?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-24\" href=\"https:\/\/logmeonce.com\/resources\/how-to-prevent-email-phishing\/#What_should_I_do_if_I_clicked_a_phishing_link_but_entered_nothing\" >What should I do if I clicked a phishing link but entered nothing?<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-25\" href=\"https:\/\/logmeonce.com\/resources\/how-to-prevent-email-phishing\/#Sources\" >Sources<\/a><\/li><\/ul><\/nav><\/div>\n<h2 id=\"tldr\"><span class=\"ez-toc-section\" id=\"TLDR\"><\/span>TL;DR<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<ul>\n<li>Pause before you click, reply or open an attachment. Verify urgent requests through a website or phone number you look up yourself, never through details in the message.<\/li>\n<li>Turn on multi-factor authentication (MFA) everywhere, keep devices updated and use unique passwords, so a stolen password alone is not enough.<\/li>\n<li>Report phishing, then delete it. Do not click anything in it, including \u201cunsubscribe\u201d links.<\/li>\n<li>Organizations need layers: filtering, email authentication, phishing-resistant MFA, least-privilege access, training and an incident-response plan.<\/li>\n<li>If you already clicked, change the affected passwords now, contact your financial institution and watch for unauthorized activity.<\/li>\n<\/ul>\n<h2 id=\"why-phishing-still-works\"><span class=\"ez-toc-section\" id=\"Why_phishing_still_works\"><\/span>Why phishing still works<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Phishing succeeds because it targets people, not software. A message arrives that looks like your bank, your boss, a delivery service or your IT department. It creates pressure, and you act before you think. CISA describes defense as <a href=\"https:\/\/www.cisa.gov\/secure-our-world\/recognize-and-report-phishing\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">behavioral as well as technical<\/a>: recognize the manipulation, resist the requested action, report it and delete it.<\/p>\n<p>There is also bad news about the old advice. Typos used to give scammers away. CISA now notes that perfect grammar is <a href=\"https:\/\/www.cisa.gov\/secure-our-world\/recognize-and-report-phishing\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">no longer a reliable sign of safety<\/a>, because AI tools can produce polished messages. So the habits below focus on what a message asks you to do and where it really comes from, not on how well it is written.<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/media.babylovegrowth.ai\/blog-images\/organization-6456\/1793206958263_Why-phishing-still-works-overview-diagram.jpeg\" alt=\"Why phishing still works \u2014 overview diagram\" title=\"\"><\/p>\n<h2 id=\"layer-one-how-to-recognize-a-phishing-email\"><span class=\"ez-toc-section\" id=\"Layer_one_how_to_recognize_a_phishing_email\"><\/span>Layer one: how to recognize a phishing email<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Most phishing emails share a handful of traits. You do not need all of them to be present. One is enough to slow down.<\/p>\n<h3 id=\"the-red-flags\"><span class=\"ez-toc-section\" id=\"The_red_flags\"><\/span>The red flags<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>The Government of Canada\u2019s <a href=\"https:\/\/www.getcybersafe.gc.ca\/en\/resources\/7-red-flags-phishing\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">seven red flags of phishing<\/a> cover the ground well, and CISA\u2019s list overlaps with it. Put together, watch for these:<\/p>\n<ul>\n<li><strong>Urgency or threats.<\/strong> \u201cYour account will be closed today.\u201d \u201cPayment overdue.\u201d Fear and urgency are designed to short-circuit judgment.<\/li>\n<li><strong>A request for sensitive data.<\/strong> Passwords, Social Security numbers, card numbers, one-time codes. The FBI says that companies <a href=\"https:\/\/www.fbi.gov\/how-we-can-help-you\/common-frauds-and-scams\/spoofing-and-phishing\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">generally do not contact you<\/a> to ask for your username or password.<\/li>\n<li><strong>A message you did not expect.<\/strong> An invoice for something you never bought, a package you never ordered, a shared document from someone you barely know.<\/li>\n<li><strong>A sender address or link that does not match.<\/strong> The display name says your bank, but the domain behind it is something else. The State Department advises <a href=\"https:\/\/www.state.gov\/defending-against-phishing-attacks\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">calmly checking the sender domain<\/a> and watching for fear tactics instead of reacting under pressure.<\/li>\n<li><strong>Shortened or untrusted URLs.<\/strong> CISA lists untrusted shortened links among common indicators. Hover over a link (or press and hold on a phone) to preview where it goes before you tap.<\/li>\n<li><strong>Unexpected attachments.<\/strong> The FBI recommends never opening unsolicited attachments from unknown senders, and being <a href=\"https:\/\/www.fbi.gov\/how-we-can-help-you\/common-frauds-and-scams\/spoofing-and-phishing\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">cautious even with attachments forwarded by others<\/a>.<\/li>\n<li><strong>Offers that are too good to be true.<\/strong> Prizes, refunds and gift cards you did not ask for.<\/li>\n<\/ul>\n<h3 id=\"a-10-second-check-before-you-click\"><span class=\"ez-toc-section\" id=\"A_10-second_check_before_you_click\"><\/span>A 10-second check before you click<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Ask yourself four questions:<\/p>\n<ol>\n<li>Was I expecting this message?<\/li>\n<li>Does it ask me to click, download, log in, pay or share something?<\/li>\n<li>Is it pushing me to hurry?<\/li>\n<li>Does the sender\u2019s address match the organization it claims to be?<\/li>\n<\/ol>\n<p>If the answer to the second question is yes and any other answer feels off, stop. NIST gives the same advice for messages that request a link click, an attachment download, a fund transfer, a login or sensitive information: <a href=\"https:\/\/www.nist.gov\/itl\/smallbusinesscyber\/guidance-topic\/phishing\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">pause before acting<\/a>.<\/p>\n<h2 id=\"what-to-do-with-a-suspicious-message\"><span class=\"ez-toc-section\" id=\"What_to_do_with_a_suspicious_message\"><\/span>What to do with a suspicious message<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>CISA\u2019s sequence is simple: recognize, resist, report, delete. In practice:<\/p>\n<ol>\n<li><strong>Do not click, reply or open attachments.<\/strong> That includes unsubscribe links, which in a phishing email can confirm that your address is live.<\/li>\n<li><strong>Verify through a separate channel if it might be real.<\/strong> If the message may concern an account you actually hold, the FTC says to <a href=\"https:\/\/consumer.ftc.gov\/articles\/how-recognize-avoid-phishing-scams\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">contact the company using a known-real phone number or website<\/a>. The FBI adds that you should look up the organization\u2019s number independently instead of using contact details supplied by a suspected scammer.<\/li>\n<li><strong>Report it.<\/strong> Use your email service\u2019s report-spam or report-phishing button. The FTC also says you can forward phishing emails to reportphishing@apwg.org, forward phishing texts to 7726 (SPAM) and report fraud attempts at ReportFraud.ftc.gov.<\/li>\n<li><strong>Delete it.<\/strong> Once reported, remove it so nobody in your household or office opens it later.<\/li>\n<\/ol>\n<p>A good rule of thumb: never use anything inside the message to check the message. The phone number, the \u201cverify here\u201d button and the reply address all belong to whoever wrote it.<\/p>\n<h2 id=\"layer-two-protect-your-accounts-and-devices\"><span class=\"ez-toc-section\" id=\"Layer_two_protect_your_accounts_and_devices\"><\/span>Layer two: protect your accounts and devices<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Even careful people slip once. The goal of this layer is that one slip does not become a breach. The FTC\u2019s baseline advice is automatically updated security software on computers and phones, multi-factor authentication on accounts, and <a href=\"https:\/\/consumer.ftc.gov\/articles\/how-recognize-avoid-phishing-scams\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">backups of computer and phone data<\/a>. It also notes that spam filters may keep many phishing emails out of your inbox, but extra layers help.<\/p>\n<h3 id=\"turn-on-multi-factor-authentication\"><span class=\"ez-toc-section\" id=\"Turn_on_multi-factor_authentication\"><\/span>Turn on multi-factor authentication<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>If a scammer captures your password on a fake login page, MFA is often what stops them from using it. Prioritize email, banking, cloud storage and anything that can reset other passwords. Your email account matters most, because anyone who controls it can reset almost everything else.<\/p>\n<p>Where you have a choice, prefer stronger methods over text-message codes. NIST and CISA both recommend <a href=\"https:\/\/www.nist.gov\/itl\/smallbusinesscyber\/guidance-topic\/phishing\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">phishing-resistant MFA<\/a> for organizations, and the same logic applies at home: the fewer codes a human has to read and type, the fewer codes a fake page can capture.<\/p>\n<h3 id=\"use-unique-passwords-and-let-software-enter-them\"><span class=\"ez-toc-section\" id=\"Use_unique_passwords_and_let_software_enter_them\"><\/span>Use unique passwords, and let software enter them<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Reused passwords turn one phishing success into many. When one site\u2019s password leaks, attackers try it everywhere else. Our article on <a href=\"https:\/\/logmeonce.com\/blog\/password-management\/password-reuse-convenient-but-dangerous\" target=\"_blank\" rel=\"noopener\">why password reuse is dangerous<\/a> goes deeper on how that plays out.<\/p>\n<p>A password manager helps with phishing in a second, less obvious way. It fills credentials based on the site\u2019s actual address. If you land on a look-alike page, the manager will not recognize it and will not fill anything in, which is a useful warning that something is wrong. The UK\u2019s National Cyber Security Centre lists <a href=\"https:\/\/www.ncsc.gov.uk\/guidance\/phishing\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">password managers and single sign-on<\/a> among the ways to reduce manual password entry, alongside alternatives such as biometrics and smartcards. If you are weighing the safety of storing passwords this way, read <a href=\"https:\/\/logmeonce.com\/blog\/password-management\/are-password-managers-safe-how-to-find-a-secure-password-manager\" target=\"_blank\" rel=\"noopener\">are password managers safe<\/a> and <a href=\"https:\/\/logmeonce.com\/blog\/security\/the-incredible-benefits-of-using-a-password-manager\" target=\"_blank\" rel=\"noopener\">the benefits of using a password manager<\/a>.<\/p>\n<h3 id=\"keep-devices-and-backups-current\"><span class=\"ez-toc-section\" id=\"Keep_devices_and_backups_current\"><\/span>Keep devices and backups current<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Malicious attachments and links often rely on known flaws in out-of-date software. Turn on automatic updates for your operating system, browser, phone and security software. Keep backups so that, if an attachment does install ransomware or other malware, you can restore your files instead of paying or losing them.<\/p>\n<h3 id=\"limit-what-you-publish\"><span class=\"ez-toc-section\" id=\"Limit_what_you_publish\"><\/span>Limit what you publish<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Spammers can harvest any email address posted online. North Carolina\u2019s state IT department suggests avoiding publishing your email address where you can and reading privacy policies to see how your address will be used. A separate address for newsletters, shopping and sign-ups keeps your main inbox cleaner and makes unexpected mail easier to spot.<\/p>\n<h2 id=\"layer-three-how-organizations-reduce-phishing-risk\"><span class=\"ez-toc-section\" id=\"Layer_three_how_organizations_reduce_phishing_risk\"><\/span>Layer three: how organizations reduce phishing risk<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Training alone will not protect a company, and neither will filters alone. Joint guidance from CISA, the NSA, the FBI and MS-ISAC, <a href=\"https:\/\/www.cisa.gov\/sites\/default\/files\/2023-10\/Phishing%20Guidance%20-%20Stopping%20the%20Attack%20Cycle%20at%20Phase%20One%5F508c.pdf\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">Phishing Guidance: Stopping the Attack Cycle at Phase One<\/a>, recommends combining recurring social-engineering training and reporting with email filtering, antivirus or endpoint protection, email authentication such as DMARC, MFA (preferably phishing-resistant) and least-privilege account management, plus an incident-response process.<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/media.babylovegrowth.ai\/blog-images\/organization-6456\/1793206997222_Organizational-defenses-against-phishing-attacks.jpeg\" alt=\"Organizational defenses against phishing attacks\" title=\"\"><\/p>\n<p>The UK NCSC reaches the same conclusion from a different direction: because <a href=\"https:\/\/www.ncsc.gov.uk\/guidance\/phishing\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">no single control stops every attack<\/a>, you need several layers, starting with making it hard for attackers to reach your users at all.<\/p>\n<h3 id=\"a-layered-checklist\"><span class=\"ez-toc-section\" id=\"A_layered_checklist\"><\/span>A layered checklist<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<table>\n<thead>\n<tr>\n<th>Layer<\/th>\n<th>What to do<\/th>\n<th>Why it helps<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Reach<\/td>\n<td>Filter spam and malicious mail; publish SPF, DKIM and DMARC records for your domain<\/td>\n<td>Fewer phishing emails arrive, and attackers find it harder to impersonate your domain<\/td>\n<\/tr>\n<tr>\n<td>Recognize<\/td>\n<td>Run recurring training and make reporting easy<\/td>\n<td>Employees spot and flag lures, which gives IT an early warning<\/td>\n<\/tr>\n<tr>\n<td>Resist<\/td>\n<td>Enforce MFA, preferably phishing-resistant; use a password manager or single sign-on<\/td>\n<td>A stolen password alone does not open the door<\/td>\n<\/tr>\n<tr>\n<td>Limit<\/td>\n<td>Apply least privilege, review access regularly and remove inactive accounts<\/td>\n<td>A compromised account can reach less<\/td>\n<\/tr>\n<tr>\n<td>Respond<\/td>\n<td>Keep an incident-response plan and remediate compromised credentials<\/td>\n<td>Faster containment when something gets through<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>The NCSC specifically recommends restricting privileged access to the minimum necessary, regularly reviewing and revoking unnecessary privileges, removing inactive accounts and reducing password reuse through sensible password policies.<\/p>\n<h3 id=\"training-that-works\"><span class=\"ez-toc-section\" id=\"Training_that_works\"><\/span>Training that works<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Make it short, recurring and tied to a single reporting habit. Employees should know exactly what to do with a suspicious email: use the report button, do not forward it around, and tell IT if they already opened a link or attachment. The joint CISA guidance includes reporting opened emails, links and attachments, and a no-blame culture is what makes people actually do that. Someone who fears punishment will stay quiet for three days, and those three days are when the damage happens.<\/p>\n<h3 id=\"handling-small-business-realities\"><span class=\"ez-toc-section\" id=\"Handling_small-business_realities\"><\/span>Handling small-business realities<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Small teams often share logins, use personal email for work and have no IT department. Start with the basics: require MFA on email and finance accounts, give everyone a password manager so shared credentials are not pasted into chat, and agree on a rule that any payment-detail change is confirmed by phone using a number already on file. That one rule defeats a large share of invoice and executive-impersonation scams.<\/p>\n<h2 id=\"our-perspective-where-phishing-defense-usually-breaks-down\"><span class=\"ez-toc-section\" id=\"Our_perspective_where_phishing_defense_usually_breaks_down\"><\/span>Our perspective: where phishing defense usually breaks down<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>We build password and identity security tools, so we see the same pattern repeatedly. People are told to \u201cbe careful,\u201d but nobody makes the careful path the easy one. A person who has 80 accounts, reuses a handful of passwords and has to retype codes all day will eventually enter a credential on the wrong page.<\/p>\n<p>So we focus on removing the decision where possible. A password manager that fills only on the genuine site turns a fake page into a visible mismatch. Passwordless and multi-factor authentication mean a captured password is not the end of the story. Dark web monitoring tells you when a credential has already leaked, so you can change it before someone tries it. None of this replaces judgment, but it means one mistake is less likely to cost you an account.<\/p>\n<p>Our advice is to pick two or three habits and make them automatic: verify urgent requests on a separate channel, never reuse a password and turn on MFA everywhere it is offered. Do those and you have dealt with the bulk of everyday risk.<\/p>\n<blockquote>\n<p><em>\u2014 Mike<\/em><\/p>\n<\/blockquote>\n<h2 id=\"tools-that-help-you-put-this-into-practice\"><span class=\"ez-toc-section\" id=\"Tools_that_help_you_put_this_into_practice\"><\/span>Tools that help you put this into practice<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>If you want a ready-made way to cover the account-protection layer, we offer plans for individuals, families and teams. For personal use, <a href=\"https:\/\/logmeonce.com\/password-manager\" target=\"_blank\" rel=\"noopener\">our password manager plans<\/a> include Professional at $2.50 per month, Ultimate at $3.25 per month and Family at $4.99 per month, and a free Premium plan at $0.00 per month is listed on our <a href=\"https:\/\/logmeonce.com\/pricing-and-comparison\" target=\"_blank\" rel=\"noopener\">pricing and comparison page<\/a>. Dark Web Monitoring is $1.67 per month, and Family Dark Web Monitoring is $3.34 per month. For organizations, Teams is $4.00 per month per user and Business is $7.99 per month per user on our <a href=\"https:\/\/logmeonce.com\/business-pricing-and-comparison\" target=\"_blank\" rel=\"noopener\">business pricing page<\/a>. Enterprise pricing is not published there.<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/csuxjmfbwmkxiegfpljm.supabase.co\/storage\/v1\/object\/public\/blog-images\/organization-6456\/1760417791460_logmeonce.jpg\" alt=\"Logmeonce\" title=\"\"><\/p>\n<p>If you are interested in removing passwords from the login step entirely, see how <a href=\"https:\/\/logmeonce.com\/passwordless-mfa\" target=\"_blank\" rel=\"noopener\">passwordless MFA<\/a> works, and use the <a href=\"https:\/\/logmeonce.com\/identity-theft-protection-dark-web-scan-and-monitoring\" target=\"_blank\" rel=\"noopener\">dark web scan<\/a> to see whether your email address has already appeared in exposed data.<\/p>\n<h2 id=\"if-you-already-clicked-the-first-hour\"><span class=\"ez-toc-section\" id=\"If_you_already_clicked_the_first_hour\"><\/span>If you already clicked: the first hour<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Mistakes happen to careful people. Speed matters more than embarrassment. NIST\u2019s guidance for after a phishing incident boils down to the steps below.<\/p>\n<ol>\n<li><strong>Disconnect if you opened an attachment.<\/strong> If you think malware may have installed, take the device off the network and run your security software. For a work device, tell IT immediately.<\/li>\n<li><strong>Change the affected passwords.<\/strong> Start with whatever you typed into the fake page, then any account that shares that password, replacing each with a unique, strong one. Change your email password early, since it controls resets for everything else.<\/li>\n<li><strong>Turn on or review MFA<\/strong> on those accounts, and sign out other sessions where the service allows it.<\/li>\n<li><strong>Contact your financial institution<\/strong> if you shared card or bank details, and <a href=\"https:\/\/www.nist.gov\/itl\/smallbusinesscyber\/guidance-topic\/phishing\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">monitor for unauthorized transactions<\/a>.<\/li>\n<li><strong>Report it.<\/strong> Use ReportFraud.ftc.gov and forward the email to reportphishing@apwg.org, as the <a href=\"https:\/\/consumer.ftc.gov\/articles\/how-recognize-avoid-phishing-scams\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">FTC advises<\/a>.<\/li>\n<li><strong>For organizations:<\/strong> notify the right people under your incident-response plan. If personal data may have been compromised and creates identity-theft risk, NIST says to notify affected parties and check the breach-notification requirements that apply to you.<\/li>\n<\/ol>\n<p>If you shared a Social Security number or other identity data, consider identity monitoring. Our <a href=\"https:\/\/logmeonce.com\/identity-theft-protection\" target=\"_blank\" rel=\"noopener\">identity theft protection<\/a> page explains what we offer.<\/p>\n<h2 id=\"common-mistakes-that-undo-good-defenses\"><span class=\"ez-toc-section\" id=\"Common_mistakes_that_undo_good_defenses\"><\/span>Common mistakes that undo good defenses<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<ul>\n<li><strong>Trusting the display name.<\/strong> Anyone can set a name like \u201cYour Bank.\u201d Check the address.<\/li>\n<li><strong>Calling the number in the email.<\/strong> It connects you to the scammer. Look up the number yourself.<\/li>\n<li><strong>Clicking \u201cunsubscribe\u201d on suspicious mail.<\/strong> Use the report function instead.<\/li>\n<li><strong>Assuming the email is safe because it is well written.<\/strong> AI has removed that signal.<\/li>\n<li><strong>Treating MFA as optional on \u201cunimportant\u201d accounts.<\/strong> Low-value accounts often share a password with high-value ones.<\/li>\n<li><strong>Never practicing the response.<\/strong> Teams that rehearse reporting handle a real incident far better than teams that only read a policy.<\/li>\n<\/ul>\n<h2 id=\"faq\"><span class=\"ez-toc-section\" id=\"FAQ\"><\/span>FAQ<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<h3 id=\"how-can-i-stop-phishing-emails-from-reaching-my-inbox\"><span class=\"ez-toc-section\" id=\"How_can_I_stop_phishing_emails_from_reaching_my_inbox\"><\/span>How can I stop phishing emails from reaching my inbox?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>You cannot stop all of them, but you can reduce them. Keep your email provider\u2019s spam filter on, report phishing instead of just deleting it, avoid posting your address publicly and use a separate address for sign-ups. Organizations add email filtering and authentication such as DMARC on top of that.<\/p>\n<h3 id=\"what-is-the-best-defense-against-phishing-emails\"><span class=\"ez-toc-section\" id=\"What_is_the_best_defense_against_phishing_emails\"><\/span>What is the best defense against phishing emails?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>There is no single best defense, which is why guidance from CISA, NIST and the UK NCSC all stress layers. The most effective combination for most people is the pause-and-verify habit, unique passwords and MFA. That way a successful lure still does not hand over your account.<\/p>\n<h3 id=\"how-do-i-stop-a-scammer-from-using-my-email\"><span class=\"ez-toc-section\" id=\"How_do_I_stop_a_scammer_from_using_my_email\"><\/span>How do I stop a scammer from using my email?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Change your email password to a unique one, turn on MFA and review account recovery options and forwarding rules for anything you did not set up. Sign out of other sessions where possible. If scammers are only spoofing your address, your account may not be compromised at all, but a password change and MFA are still sensible.<\/p>\n<h3 id=\"what-should-i-do-if-i-clicked-a-phishing-link-but-entered-nothing\"><span class=\"ez-toc-section\" id=\"What_should_I_do_if_I_clicked_a_phishing_link_but_entered_nothing\"><\/span>What should I do if I clicked a phishing link but entered nothing?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Often the risk is lower, but a link can still lead to malware. Run your security software, keep your system updated and watch for unusual behavior. If you used a work device, tell IT. If you entered a password anywhere, change it right away.<\/p>\n<h2 id=\"sources\"><span class=\"ez-toc-section\" id=\"Sources\"><\/span>Sources<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<ul>\n<li><a href=\"https:\/\/www.cisa.gov\/secure-our-world\/recognize-and-report-phishing\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">Recognize and Report Phishing, CISA<\/a><\/li>\n<li><a href=\"https:\/\/www.nist.gov\/itl\/smallbusinesscyber\/guidance-topic\/phishing\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">Phishing, NIST<\/a><\/li>\n<li><a href=\"https:\/\/www.fbi.gov\/how-we-can-help-you\/common-frauds-and-scams\/spoofing-and-phishing\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">Spoofing and Phishing, FBI<\/a><\/li>\n<li><a href=\"https:\/\/consumer.ftc.gov\/articles\/how-recognize-avoid-phishing-scams\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">How To Recognize and Avoid Phishing Scams, FTC<\/a><\/li>\n<li><a href=\"https:\/\/www.getcybersafe.gc.ca\/en\/resources\/7-red-flags-phishing\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">The 7 red flags of phishing, Get Cyber Safe<\/a><\/li>\n<li><a href=\"https:\/\/www.state.gov\/defending-against-phishing-attacks\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">Defending Against Phishing Attacks, U.S. Department of State<\/a><\/li>\n<li><a href=\"https:\/\/www.cisa.gov\/sites\/default\/files\/2023-10\/Phishing%20Guidance%20-%20Stopping%20the%20Attack%20Cycle%20at%20Phase%20One%5F508c.pdf\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">Phishing Guidance: Stopping the Attack Cycle at Phase One, CISA and partners<\/a><\/li>\n<li><a href=\"https:\/\/www.ncsc.gov.uk\/guidance\/phishing\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">Phishing attacks: defending your organisation, UK NCSC<\/a><\/li>\n<\/ul>\n\n<div style=\"font-size: 0px; height: 0px; line-height: 0px; margin: 0; padding: 0; clear: both;\"><\/div>","protected":false},"excerpt":{"rendered":"<p>Learn how to prevent email phishing with habits, account settings and layered controls for individuals and businesses, plus what to do if you already clicked.<\/p>\n","protected":false},"author":0,"featured_media":248454,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-248452","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-logmeonce"],"acf":[],"_links":{"self":[{"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/posts\/248452","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/comments?post=248452"}],"version-history":[{"count":1,"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/posts\/248452\/revisions"}],"predecessor-version":[{"id":248453,"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/posts\/248452\/revisions\/248453"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/media\/248454"}],"wp:attachment":[{"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/media?parent=248452"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/categories?post=248452"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/tags?post=248452"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}