How to Spot a Scam Email in 10 Seconds: A Real-World MSP Guide
Barely a week goes by without a client forwarding me an email with a short, nervous note attached: "Hey Andy, this looks legit, but something feels off. Can you take a look?"
Four times out of five, their gut instinct is spot on. It is a scam.
For years, cybersecurity advice told us to look out for bad spelling, broken English, and obvious typos. But in today's world of AI tools and pixel-perfect corporate impersonation, that advice is completely obsolete. Today's phishing emails look identical to genuine notifications from Australia Post, Microsoft 365, Xero, or your bank.
You do not need a computer science degree to protect yourself. Every scam email shares common telltale fingerprints once you know where to look.
Here is what is currently hitting Australian inboxes, why these scams work, and the simple 10-second sniff test you can use to catch them every single time.
The "Big 4" Scam Emails Hitting Aussie Inboxes Right Now
As a managed service provider, I see hundreds of suspicious emails every month. Almost every attack targeting local businesses falls into one of these four categories:
1. The Australia Post "Unpaid Delivery Fee"
What it looks like: A clean email or SMS stating: *"We attempted delivery of your parcel today, but a small $2.85 handling fee is pending. Click here to confirm your details."*
Why it works: Everyone orders online. Scammers do not need to know what you ordered—they simply play the odds, banking on someone in your office waiting on a package.
The giveaway: Look closely at the website link. It will never direct to `auspost.com.au`. Instead, you will see fake domains like `auspost-delivery-tracking-portal.com` or `parcel-redirect-au.net`.
What to do: Never click the link. Open the official Australia Post app or visit `auspost.com.au` directly and enter your tracking number manually.
2. The Urgent Supplier / Overdue Invoice (Xero & MYOB)
What it looks like: An email appearing to come from a familiar vendor or accounting platform: *"Overdue Invoice #4092 - Payment Required Within 24 Hours."* It includes an attached PDF or a link to view the invoice.
Why it works: The word *"Overdue"* triggers instant panic, particularly for accounts teams or business owners who pride themselves on great supplier relationships.
The giveaway: The sender's email address does not match the actual vendor's domain. In worse cases, the bank account details on the PDF have quietly changed, or the link takes you to a fake Microsoft login screen designed to steal your credentials.
What to do: If an invoice is unexpected, or if a regular supplier suddenly announces new bank details, stop. Pick up the phone and call their known, trusted number to verify.
3. The Microsoft 365 "Account Expiry / Storage Full" Panic
What it looks like: A sharp, Microsoft-branded notice warning: *"Your password expires today,"* or *"Your mailbox storage is 98% full. Incoming emails are currently being blocked."*
Why it works: Small businesses live inside Microsoft 365. The fear of missing an urgent client email or losing access to Outlook induces immediate panic.
The giveaway: Microsoft never sends emails asking you to click a button to keep your current password or unlock storage. The sender address usually reveals strange domains like `admin@secure-tenant-update365.info` rather than `@microsoft.com`.
What to do: Log into the official Microsoft portal directly at `office.com`. If there is a legitimate issue, an official notification banner will be waiting inside your dashboard.
4. The "Quick Favour" / Executive Impersonation
What it looks like: A brief, plain-text email appearing to come from your CEO, manager, or colleague: *"Hi, are you at your desk? I'm stuck in a meeting and need a quick favour. Can you buy three Apple gift cards or transfer an urgent payment?"*
Why it works: It preys on workplace helpfulness and respect for authority. The casual, urgent tone discourages staff from pausing to question the request.
The giveaway: Check the actual email address behind the display name. While the name says your boss or colleague, the address is often a throwaway webmail account like `exec.andrew1982@gmail.com`.
What to do: Never handle financial transactions or credential requests over email alone. Send them a quick message on Teams, or ask them in person: *"Hey, did you just ask me for this?"*
The 10-Second MSP Sniff Test
Whenever an email asks you to click a link, open an attachment, or take urgent action, run through these three fast checks:
1. The Domain Check (3 Seconds)
Do not trust the display name. Attackers easily set their sender name to "ANZ Security", "Australia Post", or "Microsoft Support".
On your computer, hover over the sender's name to reveal the actual email address behind it:
Legitimate: `support@telstra.com.au`
Scam: `support@telstra-billing-notification.net`
If the domain contains odd hyphens, strange extensions like `.xyz` or `.info`, or subtle misspellings like `@m1crosoft.com`, Right click, block sender and delete it.
2. The Hover Test (3 Seconds)
Before clicking any link or button, hover your mouse cursor over it without clicking.
In the bottom-left corner of your email client or browser window, a small preview shows the true destination URL:
If the button says "Review Your NAB Account", but the preview points to `https://login-verification-nab.ru/auth`, you are looking at a credential-stealing site.
On a smartphone, press and hold the link for one second to view the preview before opening it.
3. Step Out of the Email (4 Seconds)
Apply the golden rule of email security: Never use the links or phone numbers provided inside a suspicious email.
If your bank, utility company, or cloud provider says an action is required, close the email. Open your web browser, head to your usual bookmark, and log in directly. If an issue genuinely needs your attention, an official notification will be waiting in your account dashboard.
Behind the Scenes: Email Spoofing & The Digital Wax Seal
Have you ever wondered why scammers can pretend to be someone else in the first place?
When email was invented over 40 years ago, it was designed with zero built-in security. Think of physical mail: anyone can take a plain envelope, write your company's name and address on the back as the return address, and drop it in a post box. The postie delivers it without verifying who actually posted it.
Historically, email worked the exact same way. Anyone could send an email with `ceo@yourcompany.com.au` stamped at the top. This trick is known as email spoofing.
The Subtle Giveaway: "Via" or "On Behalf Of"
While scammers try to spoof legitimate names, modern mail systems like Microsoft 365 often catch discrepancies and display a subtle clue right next to the sender:
`admin@yourcompany.com.au via sendgrid.net`
`john.doe@external-server.com on behalf of CEO Name`
If an email claims to be an internal communication from your own team, but Outlook shows a "via" or "on behalf of" tag pointing to an external server, treat it as hostile.
The Invisible Shield: SPF, DKIM, and DMARC
To fix this flaw, modern domain security relies on three core standards that act as a digital passport and wax seal:
SPF (Sender Policy Framework): A public record telling the internet which specific servers (like Microsoft 365) are authorised to send emails on your behalf.
DKIM (DomainKeys Identified Mail): A cryptographic signature attached to every outgoing email, proving it was not altered in transit.
DMARC (Domain-based Message Authentication, Reporting & Conformance): The rulebook instructing recipient servers to automatically quarantine or reject any email that fails SPF or DKIM.
If your organisation has not properly configured and enforced DMARC, cybercriminals can send fake invoices to your clients using your exact domain name—and recipient servers will let them straight through.
You should not have to decode raw email headers every day. A good IT partner configures these DNS defences behind the scenes so spoofed emails never reach inboxes in the first place. It happens to be one of our services we offer: Services | It Savvy
What If You Already Clicked?
Mistakes happen. Cybercriminals send millions of these emails because they only need one distracted moment between meetings to catch someone off guard.
If you entered your login credentials, approved an authenticator prompt, or opened an unexpected attachment, do not panic and do not hide it. Quick action makes all the difference.
Follow our emergency step-by-step checklist here: What to Do If You Clicked a Phishing Link in Microsoft 365 What to Do If You Clicked a Phishing Link in Microsoft 365 | I.T. Savvy
A Culture of "Check Twice, Click Once"
Cybercriminals rarely spend their days trying to crack through enterprise-grade firewalls. Instead, they exploit busy schedules, distraction, and our natural instinct to be helpful.
At I.T. Savvy, we encourage our clients to operate with zero embarrassment:
** We would rather check 20 false alarms than clean up one compromised mailbox.
If you or your team ever receive an email that feels slightly off, forward it through. No tech jargon, no judgement—just quick verification and peace of mind.
Comments