The useful starting point
A message can imitate a familiar organisation while directing the reader to an unexpected destination. Urgency, unusual requests and a changed communication pattern are reasons to investigate. No single visual clue proves that every message is legitimate or fraudulent.
A small step to try
Use the relevant reporting process and a known contact route when a request needs confirmation. Avoid opening an unexpected attachment merely to see whether it is genuine. CISA’s guidance provides practical recognition and reporting context; a specific incident may require the organisation’s own response process. Keep sensitive details in approved private channels while the question is being assessed.