The warning signs of a phishing email, the scams Malaysian offices see most, and exactly what to do if someone has already clicked.
What Phishing Is
A phishing email pretends to come from someone you trust — a bank, a courier, a supplier, your own boss — to get you to click a link, open an attachment, enter a password or send money. It is the most common way attackers get into small companies, because it targets people rather than systems.
Eight Warning Signs
- The sender address does not match the name. "Maybank" sent from a Gmail address, or a domain one letter off from the real one.
- Urgency or threats. "Your account will be suspended today." "Pay within one hour."
- A link that goes somewhere else. Hover over it (on a phone, press and hold) and read the real address before clicking.
- An unexpected attachment, especially a ZIP file, a document that asks you to "enable content", or an HTML file.
- A request to log in from a link in the email, rather than going to the site yourself.
- Changed bank details. A supplier "has a new account" — the classic invoice scam.
- A request from the boss to act quietly — buy gift cards, transfer money, keep it between the two of you.
- Generic greetings and odd language — though modern phishing is often well written, so do not rely on spelling mistakes.
Scams Malaysian Offices See Most
| Scam | What it looks like |
|---|---|
| Fake courier | "Your parcel could not be delivered — pay a small fee" |
| Fake bank or e-wallet alert | "Unusual login detected — verify your account" |
| Invoice / payment redirection | A real-looking supplier email with new bank details |
| Fake Microsoft 365 or Google login | "Your mailbox is full" or "Shared document" with a login page |
| Boss impersonation | An urgent request from a director's name on an outside address |
The Rule for Money
Any change to bank details, and any urgent payment request, gets confirmed by phone — using a number you already have, not one in the email. This single rule stops the most expensive scams.
Someone Clicked. Now What?
Move fast, and do not blame the person — people who fear blame hide incidents.
- Disconnect the device from Wi-Fi or the network if a file was opened.
- Change the password of any account whose details were entered, from a different device, and sign out other sessions.
- Check that multi-factor authentication is on for that account.
- Tell your IT support immediately, with the email itself (forward it as an attachment, or take a screenshot).
- If money was sent, call your bank at once to try to stop the transfer, and report it to the police.
- If personal data may have been exposed, check whether you need to notify under the PDPA — see our PDPA IT checklist.
Reduce the Risk Before It Happens
- Turn on multi-factor authentication for every email account — a stolen password alone is then not enough
- Use your email service's spam and phishing filtering, and keep it on
- Keep devices updated and protected with endpoint security
- Remind staff regularly, with real examples
Get Help
If your company has no IT person to call when someone clicks, that gap is the real risk. See our cybersecurity services for SMEs or managed IT plans.