How to Spot a Phishing Email: Essential Guide for HVAC Companies

With over 85% of successful data breaches starting with a phishing email, HVAC companies face unique risks that make them attractive targets for cybercriminals. From access to residential and commercial properties to valuable customer databases, your business holds exactly what hackers want.

But here’s the challenge: phishing attacks in 2025 look nothing like the obvious scams of the past. Attackers now harness advanced generative AI models to craft highly personalised, believable scams at unprecedented speed, making them incredibly difficult to spot.

For HVAC companies, this means emails that perfectly mimic your equipment suppliers, certification bodies, or even your own management team. Here’s how to protect your business.

Why HVAC Companies Are Prime Targets

Access to Properties: Your engineers may have keys, codes, and schedules for residential and commercial properties which is valuable information for criminals planning physical break-ins.

Customer Data: Client contact details, property information, and service histories are gold mines for identity theft and targeted scams.

Supply Chain Connections: Regular communications with equipment manufacturers, parts suppliers, and certification bodies create perfect phishing opportunities.

Mobile Workforce: Engineers checking emails on phones while on job sites are more vulnerable to quick, impulsive clicks.

Seasonal Urgency: Busy periods (heatwaves, cold snaps) create pressure to respond quickly without proper verification.

The New Generation of Phishing Attacks Targeting HVAC

AI-Generated Precision Attacks

AI Tools are used to zero in on the main concerns of employees, and turn those pain points into a convincing phishing email which are free of grammatical mistakes. For HVAC companies, this means:

• Supplier emails that appear perfect: “Your parts order #12345 has been delayed due to supply chain issues. Click here to expedite shipping.”
• Certification renewal scams: Emails that perfectly match Gas Safe or other certification body communications
• Equipment recall notices: Fake urgent safety notices about installed equipment requiring immediate action

Deepfake Voice and Video Attacks

Attackers can use GenAI to clone the voice of a trusted contact and create deepfake audio. Imagine, for example, an employee receives a voice message from someone who sounds exactly like the CFO, requesting an urgent bank transfer.

HVAC-specific scenarios:

• Voice messages from “the MD” requesting emergency payment to a new supplier
• Video calls from fake “area managers” asking for customer access codes
• WhatsApp voice notes from “colleagues” needing urgent job information

Business Email Compromise (BEC) 2.0

Techniques like Business Email Compromise (BEC), Vendor Email Compromise (VEC), and Account Takeover (ATO) use hacked credentials and real email threads to fool employees, but now they’re enhanced with AI precision.

What BEC targeting HVAC looks like:

• Hijacked email threads with existing suppliers, adding malicious payment requests
• Fake urgent communications during busy seasons when verification is rushed
• Impersonation of facilities managers requesting “emergency” system access

How to Spot Modern Phishing Emails: The HVAC Professional’s Guide

01. The Urgency Test

Red Flags:

• “Urgent equipment recall – respond within 24 hours”
• “Your Gas Safe certification expires tomorrow – renew now”
• “Emergency parts order needed for critical repair”

HVAC Reality Check: Legitimate suppliers and certification bodies rarely create genuine emergencies through email. When in doubt, phone them directly.

02. Sender Verification (The Most Important Check)

What to look for:

• Email addresses with slight misspellings (e.g., “danf0ss.com” instead of “danfoss.com”)
• Generic addresses from major suppliers (real suppliers use specific department emails)
• Mismatched display names and email addresses

HVAC-Specific Examples:

• An email claiming to be from “Honeywell Support” but sent from gmail.com
• “Worcester Bosch” communications from a .co.uk address instead of worcester-bosch.co.uk
• Certification emails from generic domains instead of official government sites

03. Content and Language Analysis

Modern phishing emails are grammatically perfect, but watch for:

• Terminology that doesn’t match how your real suppliers communicate
• Generic references (“your recent order”) instead of specific part numbers
• Pressure tactics unusual for your industry relationships

04. Link and Attachment Safety

Never click directly. Instead:

• Hover over links to see the real destination
• Look for suspicious redirect URLs or URL shorteners
• Be wary of ZIP files or documents requesting you to “enable macros”
• Check file extensions carefully (invoice.pdf.exe is not a PDF)

05. The “Too Good to Be True” Test

Common HVAC phishing lures:

• Massive discounts on equipment during peak season
• “Exclusive” training certifications for free
• Urgent requests to update payment details for better rates
• Job opportunities that seem too perfect

Current Phishing Techniques Every HVAC Team Should Know

Supplier Impersonation

The Scam: Perfect copies of emails from equipment manufacturers requesting updated payment details or urgent part orders.

The Tell: Real suppliers rarely request payment changes via email. Always verify through your established contact methods.

Certification Phishing

The Scam: Fake renewal notices for Gas Safe, F-Gas, or other certifications with urgent deadlines and immediate payment requests.

The Tell: Official certification bodies have established renewal processes that don’t rely on email links to unknown payment portals.

Customer Site Access Scams

The Scam: Emails appearing to be from property managers or facilities teams requesting immediate access to buildings or systems.

The Tell: Property managers typically coordinate access through established channels, not random email requests.

Equipment Firmware “Updates”

The Scam: Fake security alerts about installed equipment needing immediate firmware updates, with links to malicious downloads.

The Tell: Equipment manufacturers distribute firmware updates through official channels and authorised distributors, not email links.

Seasonal Emergency Scams

The Scam: During heatwaves or cold snaps, fake urgent requests for emergency parts or services, often with unusual payment terms.

The Tell: Emergency situations don’t change standard business verification procedures – if anything, they make verification more important.

What to Do If You Spot a Phishing Email

Immediate Actions:

1. Don’t click anything in the suspicious email
2. Don’t reply – even to say “this isn’t for me”
3. Don’t download any attachments
4. Do report it to your IT support team immediately

For HVAC-Specific Scenarios:

• Supplier emails: Contact the supplier directly using phone numbers from your existing records, not the email
• Certification notices: Visit the official certification body website directly, don’t use email links
• Customer requests: Verify through your established customer contact procedures
• Equipment alerts: Check directly with the manufacturer through official support channels

Team Education:

• Inform your team of suspicious emails and the tactics used as learning examples (after reporting to IT)
• Establish clear verification procedures for unusual requests
• Create a culture where “double-checking” is encouraged, not seen as inefficient

Building Phishing Resistance in Your HVAC Business

Technical Defences:

• Email filtering: Professional-grade filters that catch most phishing attempts
• Link protection: Systems that check links in real-time before allowing access
• Attachment scanning: Automatic scanning of all email attachments for malware
• Domain authentication: SPF, DKIM, and DMARC settings that verify sender authenticity

Human Defences:

• Regular training: Keep your team updated on current phishing techniques
• Verification procedures: Clear protocols for verifying unusual requests
• Reporting culture: Make it easy and encouraged to report suspicious emails
• Slow down culture: Counter the urgency tactics by building in verification time

HVAC-Specific Protections:

• Supplier verification protocols: Established methods for confirming requests from parts suppliers
• Customer communication channels: Clear procedures for verifying unusual customer requests
• Equipment manufacturer contacts: Direct contact methods that bypass email for security updates
• Certification renewal systems: Proactive tracking of renewal dates to avoid fake urgency

The Bottom Line for HVAC Companies

Modern phishing attacks use autonomous AI agents capable of handling everything from research and content creation to deployment, with AI-adaptive phishing kits creating dynamically personalised scams in real-time. This means the threat is evolving faster than ever.

But the fundamentals remain the same: verify, verify, verify. When an email creates urgency around payments, access, or credentials, slow down and verify through established channels.

Your HVAC expertise keeps buildings comfortable and safe. Applying that same methodical, safety-first approach to email security will keep your business and customers protected.

Remember: It’s better to spend five minutes verifying a legitimate email than five months recovering from a successful phishing attack.

If you’re concerned about your email security, get in touch with PS Tech for a comprehensive email security review tailored to your HVAC business operations.