How to Recognize and Report Suspicious Emails with TSN Cyber Email Security

Applies to: Microsoft 365, Outlook, Google Workspace, Gmail, and Organizations Protected by TSN Cyber Email Security
Difficulty: Beginner
Estimated Time: 5–10 minutes

Overview

Phishing emails are fraudulent messages designed to trick recipients into revealing passwords, sending money, downloading malicious files, or sharing sensitive business information.

Cybercriminals often disguise these messages to appear as though they came from a trusted company, coworker, bank, vendor, or technology provider.

TSN Cyber Email Security helps protect your organization’s email communications by identifying and filtering suspicious messages. However, no email security system can detect every threat.

This guide explains how to recognize phishing attempts, inspect suspicious messages, report potentially malicious emails, and respond safely if you accidentally interact with one.

Before You Begin:

  • Have access to your organization-approved email account.
  • Use Microsoft Outlook, Gmail, or your approved email application.
  • Know your organization’s process for reporting suspicious emails.
  • Do not open suspicious links or attachments while investigating a message.

Important: Never assume that an email is safe simply because it arrived in your Inbox or appears to come from someone you recognize.

Understanding Phishing Emails

Phishing is a form of cyberattack that uses deceptive messages to persuade someone to take an unsafe action.

Common phishing objectives include:

  • Stealing account passwords.
  • Collecting multifactor authentication codes.
  • Tricking employees into making payments.
  • Redirecting visitors to fraudulent websites.
  • Installing malicious software.
  • Accessing confidential company information.
  • Impersonating trusted employees or vendors.

Example

You receive an email claiming to be from Microsoft 365.

The message says:

“Your account will be disabled today unless you verify your password.”

It contains a link to a page that looks like the Microsoft sign-in screen.

However, the page belongs to an attacker.

If you enter your credentials, the attacker may capture them.

Important: Legitimate-looking logos, professional formatting, and familiar company names do not prove that an email is authentic.

Common Warning Signs of Phishing

1. Urgent or Threatening Language

Phishing emails frequently create pressure by claiming:

  • Your account will be suspended.
  • A payment is overdue.
  • Your password is expiring immediately.
  • You must verify your identity.
  • A delivery cannot be completed.

What to Do: Verify the request through an independent, trusted communication channel.

2. Unexpected Password Requests

Be suspicious of messages asking you to:

  • Enter your Microsoft 365 password.
  • Provide your email password.
  • Share a Keeper Master Password.
  • Send a verification code.
  • Approve an unexpected sign-in request.

Important: True Synergy Networks will never need you to disclose your existing account password or multifactor authentication codes to investigate a support issue.

3. Unfamiliar Sender Addresses

An email may display the name of someone you recognize while actually coming from an unrelated address.

Example:

Display name: Microsoft Support

Actual sender: security-alert@unrelated-example.net

The display name can be misleading.

Always review the full sender email address.

Note: A familiar address is not definitive proof of authenticity either. Real accounts can be compromised, and sender information can be spoofed.

4. Suspicious Links

A message may contain a link labeled:

“View Secure Document”

The link could actually direct you to a fraudulent login page.

What to Do: Inspect the link destination without opening it.

If you cannot verify it safely, report the message.

5. Unexpected Attachments

Attachments can contain malicious content.

Be cautious with unexpected:

  • ZIP archives.
  • Executable files.
  • Office documents asking you to enable macros.
  • HTML attachments presenting login screens.
  • Password-protected files from unfamiliar senders.

Important: Never enable macros or bypass security warnings because an unexpected email instructs you to do so.

6. Unusual Payment or Banking Requests

An attacker may impersonate a vendor or executive and request:

  • A wire transfer.
  • A change to bank account details.
  • An urgent invoice payment.
  • A gift card purchase.
  • An updated payment destination.

What to Do: Verify payment changes using a known telephone number or your organization’s established financial approval process.

Do not rely on the contact information contained in the suspicious message.

Understanding Email Spoofing

Email spoofing occurs when a message is crafted to appear as though it originated from another sender.

For example, an attacker may attempt to impersonate:

  • Your company.
  • A customer.
  • A vendor.
  • A bank.
  • Microsoft.
  • Google.
  • True Synergy Networks.

Some spoofed emails are detected and blocked by email authentication and security systems.

Others may still reach a user’s mailbox.

Important: A message that appears to come from your own email address is not necessarily evidence that someone accessed your account. It may be spoofed.

Report suspicious messages so they can be investigated.

Understanding Business Email Compromise

Business Email Compromise, or BEC, involves fraudulent messages intended to manipulate employees into transferring money or disclosing information.

Attackers may impersonate:

  • Business owners.
  • Managers.
  • Accountants.
  • Vendors.
  • Customers.
  • Payroll personnel.

Example

An email appearing to come from a manager says:

“I’m in a meeting. Please urgently update this vendor’s banking information and send the payment today.”

Even if the message appears familiar, the request should be independently verified.

Important: Never change payment instructions, payroll information, or vendor banking details based solely on an email.

Step 1: Examine the Sender

When you receive an unexpected message:

  1. Open the email without clicking links or opening attachments.
  2. Locate the sender information.
  3. Review the complete email address.
  4. Check for unusual spelling or unfamiliar domains.
  5. Compare the address with previously verified contact information.

Example:

A legitimate company domain may look like:

example.com

A deceptive domain might look like:

example-support-login.net

Important: Similar-looking domain names are not interchangeable.

Step 2: Examine the Message

Read the message carefully.

Look for:

  • Unusual requests.
  • Unexpected urgency.
  • Requests for credentials.
  • Payment changes.
  • Threats of account suspension.
  • Inconsistent language.
  • Information that does not match your normal business process.

Note: Modern phishing emails can be grammatically correct and professionally written. Good spelling does not mean a message is safe.

Step 3: Inspect Links Without Opening Them

On Windows or Mac

  1. Move your mouse pointer over the link.
  2. Do not click.
  3. Review the destination displayed by your email application or browser.
  4. Check whether the destination matches the expected website.

On iPhone or Android

  1. Avoid tapping suspicious links.
  2. If your email application supports a safe link preview, inspect the destination without opening the site.
  3. If the destination cannot be verified, stop and report the message.

Important: Some link previews may initiate network requests or display unfamiliar prompts. Do not continue if you are uncertain.

Recommendation: Instead of following an unexpected email link, open the organization’s verified website directly using a trusted bookmark or address.

Step 4: Evaluate Attachments

If an email includes an unexpected attachment:

  1. Review the sender and subject.
  2. Determine whether you were expecting the file.
  3. Check whether the message makes an unusual request.
  4. Do not open the attachment if you are uncertain.
  5. Report the email using your organization’s approved procedure.

Important: A file named “Invoice.pdf” or “Statement.docx” is not automatically safe.

Do not enable macros, install software, or disable antivirus protection to open an attachment.

Step 5: Verify Requests Independently

If a message appears to come from someone you know but requests an unusual action:

  1. Do not reply with sensitive information.
  2. Find the person’s telephone number or other contact details from a trusted source.
  3. Contact them using that known information.
  4. Ask whether they sent the request.
  5. Proceed only if the request is legitimate and authorized.

Important: Do not use an unfamiliar phone number provided within the suspicious email as your only verification method.

How to Report a Suspicious Email in Microsoft Outlook

Your organization’s Outlook environment may include a built-in reporting feature.

Option 1: Use the Report Feature

  1. Open Microsoft Outlook.
  2. Select the suspicious email.
  3. Look for Report, Report Phishing, or an organization-approved reporting button.
  4. Select the appropriate phishing or suspicious-message option.
  5. Review the confirmation.
  6. Submit the report.

Note: The location and wording of the reporting button depend on the Outlook version and your organization’s configuration.

If a reporting button is not available, follow your organization’s alternative reporting procedure.

Option 2: Contact True Synergy Networks

If your organization has instructed you to report suspicious messages directly to TSN:

  1. Leave the original message unchanged.
  2. Contact True Synergy Networks through your approved support channel.
  3. Explain why the message appears suspicious.
  4. Follow the technician’s instructions for submitting the original message.

Important: Forwarding a suspicious email normally may remove useful technical information or inadvertently expose other recipients. If TSN requests the original message as an attachment, follow the instructions provided.

Do not forward suspicious links or files to coworkers for their opinion.

How to Report a Suspicious Email in Gmail

Google Workspace users may be able to report phishing directly through Gmail.

Step 1: Open Gmail

  1. Sign in to your approved Google Workspace account.
  2. Locate the suspicious message.
  3. Open it without interacting with the links or attachments.

Step 2: Open the Message Menu

  1. Find the three-dot More menu associated with the message.
  2. Open the menu.
  3. Select Report phishing, if available.
  4. Confirm the report.

Note: This option is different from simply marking an email as spam.

Step 3: Follow Company Procedures

If the email involves your organization, a payment request, a possible compromised account, or other sensitive information, contact True Synergy Networks through the approved support channel as well.

Important: Reporting through Gmail does not necessarily mean that True Synergy Networks automatically receives a support ticket.

Understanding TSN Cyber Email Security Warnings

Depending on your organization’s email security configuration, suspicious messages may be:

  • Blocked before reaching your mailbox.
  • Quarantined for review.
  • Marked with a warning.
  • Flagged for suspicious links or attachments.
  • Delivered with an added security notification.

The exact behavior depends on your organization’s protection settings.

If You See a Warning

  1. Read the warning carefully.
  2. Do not dismiss it automatically.
  3. Avoid opening suspicious content.
  4. Follow the approved reporting process.

Important: Do not attempt to bypass security restrictions or release suspicious messages without authorization.

What to Do If You Accidentally Clicked a Suspicious Link

If you clicked a suspicious link:

  1. Do not enter any information on the page.
  2. Close the suspicious browser tab.
  3. Do not download or install anything.
  4. Contact True Synergy Networks promptly.
  5. Explain what happened and whether the page requested any information.

Important: If you entered a password, approved an authentication request, or downloaded a file, tell support immediately.

This helps determine what additional protective actions are necessary.

What to Do If You Entered Your Password

If you entered your password into a suspicious website:

  1. Stop interacting with the website.
  2. Contact True Synergy Networks immediately.
  3. Identify which account was affected.
  4. Follow the authorized password change and account security procedure.
  5. Report whether you also entered a verification code or approved an MFA request.

Important: Do not wait until you notice unauthorized activity.

A stolen password may be used quickly, even if no visible sign of compromise appears.

What to Do If You Opened a Suspicious Attachment

If you opened an unexpected attachment and now suspect it may be malicious:

  1. Stop interacting with the file.
  2. Do not enable macros or security exceptions.
  3. Do not enter account credentials into anything the file opened.
  4. Contact True Synergy Networks immediately.
  5. Describe the attachment and any unexpected activity.

Important: Do not attempt to remove suspected malware, delete security logs, or disable security software yourself.

Follow TSN’s instructions for containing or investigating the affected device.

What to Do If You Sent Money or Sensitive Information

If you responded to a phishing email by sending payment information, confidential records, or money:

  1. Notify the appropriate manager or authorized business contact immediately.
  2. Contact True Synergy Networks if accounts or systems may be affected.
  3. If money was transferred, contact your financial institution promptly using a verified number.
  4. Preserve relevant emails and transaction information.
  5. Follow your organization’s incident response process.

Important: The sooner a fraudulent payment is reported to the financial institution, the better the opportunity may be to attempt recovery. Recovery is not guaranteed.

How to Handle Emails from Known Coworkers

A message from a familiar coworker can still be suspicious.

Their account may have been compromised, or an attacker may be impersonating them.

Watch for unexpected requests such as:

  • “Send me the customer list.”
  • “Buy gift cards immediately.”
  • “Change my direct deposit details.”
  • “Open this secure file and sign in.”
  • “Send me the MFA code you just received.”

If the request is unusual, verify it through another trusted method.

Important: A recognizable sender name or an existing email thread does not prove that a message is legitimate.

Understanding QR Code Phishing

Some phishing emails include QR codes instead of traditional links.

The message may instruct you to scan a code to:

  • Verify your account.
  • Access a document.
  • Review an invoice.
  • Restore email access.
  • Update your password.

A QR code can direct your phone to a fraudulent website.

Important: Do not scan unexpected QR codes from suspicious emails.

Use the service’s verified website or application instead.

Understanding Fake Support Emails

Cybercriminals sometimes impersonate IT support teams.

A fraudulent message may claim:

  • Your computer has a security issue.
  • Your email account requires immediate verification.
  • You must install a remote support application.
  • A technician needs your password.
  • You must approve an unexpected sign-in request.

True Synergy Networks Support Safety

Only use the support methods approved by your organization.

When installing TSN remote support software, use the official instructions and approved TSN website.

Important: Do not install remote access software from an unfamiliar email link or website. If someone claims to represent True Synergy Networks and the request seems unusual, verify the request through an established TSN support channel.

Troubleshooting

I Received a Suspicious Email but Do Not See a Report Button

  1. Confirm that you are using the approved email application.
  2. Check the available message actions.
  3. Look for Report or Report Phishing.
  4. If no reporting control is available, contact True Synergy Networks.
  5. Follow your organization’s approved reporting process.

Important: Do not forward suspicious attachments to other employees.

An Email Was Marked as Suspicious, but I Think It Is Legitimate

  1. Do not bypass the warning.
  2. Review the sender and request.
  3. Verify the sender independently.
  4. Contact True Synergy Networks if the message may have been incorrectly classified.

Note: Email security systems can occasionally flag legitimate messages.

I Reported an Email but Keep Receiving Similar Messages

  1. Continue reporting new suspicious messages.
  2. Do not engage with the sender.
  3. Record whether the messages appear to follow the same pattern.
  4. Contact True Synergy Networks if the activity persists.

Important: Do not unsubscribe from obviously malicious emails. An unsubscribe link may itself be unsafe.

I Clicked a Link but Nothing Happened

  1. Do not click the link again.
  2. Close the suspicious page.
  3. Contact True Synergy Networks.
  4. Explain the link behavior and whether any information was entered.

Important: A suspicious link may still present a risk even if nothing visible happened.

I Cannot Tell Whether an Email Is Real

  1. Avoid taking the requested action.
  2. Review the full sender address.
  3. Check for suspicious links and unexpected attachments.
  4. Independently contact the supposed sender.
  5. Report the message if you remain uncertain.

Recommendation: When a message asks for an unusual financial, account, or security action, verification is more important than responding quickly.

The Email Claims My Account Will Be Locked

  1. Do not follow the email link.
  2. Open the relevant service through your approved bookmark or application.
  3. Check for legitimate account notices there.
  4. Contact True Synergy Networks if necessary.

Important: Do not provide passwords or verification codes in response to an unexpected account warning.

I Received an Unexpected MFA Notification

  1. Do not approve the request.
  2. Do not share the displayed code.
  3. Record the approximate time.
  4. Contact True Synergy Networks immediately.

Important: Unexpected authentication requests may indicate that someone is attempting to access your account.

A Coworker Already Clicked the Link

  1. Ask them to stop interacting with the message.
  2. Do not ask them to forward the suspicious link to you.
  3. Encourage them to contact True Synergy Networks immediately.
  4. Notify the authorized manager if required.

Important: Do not attempt to investigate a suspected compromised device or account using another employee’s credentials.

Best Practices for Avoiding Phishing

To reduce your risk:

  • Verify unusual requests independently.
  • Inspect sender email addresses.
  • Check link destinations before opening them.
  • Avoid unexpected attachments.
  • Never share passwords or authentication codes.
  • Do not approve MFA requests you did not initiate.
  • Use strong, unique passwords.
  • Use multifactor authentication.
  • Follow company payment verification procedures.
  • Report suspicious emails promptly.
  • Use approved support websites and applications.
  • Keep your computer and browser updated through approved processes.

Recommendation: If an email creates pressure to act immediately, verify the request before taking action.

Additional Information

  • Phishing emails attempt to trick users into revealing information or performing unsafe actions.
  • Email spoofing can make messages appear to come from trusted senders.
  • Business Email Compromise often targets payments, banking details, and confidential information.
  • Links, attachments, and QR codes can all be used in phishing attacks.
  • Microsoft Outlook and Gmail may include built-in phishing reporting options.
  • TSN Cyber Email Security can help detect, filter, and quarantine suspicious messages.
  • No email security solution detects every malicious message.
  • A familiar sender name does not guarantee authenticity.
  • Unexpected multifactor authentication requests should be treated as suspicious.
  • True Synergy Networks can assist with reporting, investigating, and responding to suspected email security incidents.

Security Reminder: Never disclose passwords, multifactor authentication codes, or confidential information in response to an unexpected email. Do not open suspicious attachments, scan unfamiliar QR codes, or install remote support software from unverified links. Always confirm unusual payment or account requests through a separate trusted communication channel. If you clicked a malicious link, entered credentials, or suspect your account has been compromised, contact True Synergy Networks immediately.