There is no one indicator of a phishing email because the criminal will use multiple methods to manipulate the user into to doing something they wouldn't normally do. Emotional ploys, pressure to download attachments and impersonations of senior staff can result in a successful attack if the employee is not careful. Constant training is key in decreasing the risk.