Phishing is when criminals use fake emails, texts or calls to trick people into handing over passwords, bank details or money. The NCSC's guide for small organisations puts it bluntly: phishing is often the way criminals get into accounts and devices in the first place.
Spam filters catch a lot, but not everything. The last line of defence is a member of staff who pauses before clicking. This post is written so you can share it with your team.
Why phishing works
Phishing messages are designed to make you act before you think. They usually pretend to come from someone you trust — a bank, a supplier, a delivery company, HMRC, a colleague or your own boss — and they create pressure: an unpaid invoice, a locked account, a parcel you'll miss, a payment that must go out today.
The UK Government's Stop! Think Fraud campaign also warns that fake emails are getting more convincing with the rise of AI. Perfect spelling and a real-looking logo are no longer proof that an email is genuine.
The red flags
The NCSC and Stop! Think Fraud list a consistent set of warning signs. None of them proves an email is a scam on its own, but each is a reason to slow down.
- The sender's address doesn't quite match. Look at the actual email address, not just the display name. Criminals use addresses that look similar to a real one, with an extra letter, a different ending, or a free email service.
- Urgency or pressure. "Act now", "within 24 hours", "your account will be closed". Genuine organisations rarely need you to act in minutes.
- A generic greeting. "Dear valued customer" can mean the sender doesn't actually know who you are.
- Unexpected attachments. Especially invoices, "documents" or files that ask you to enable editing or macros.
- Links to unfamiliar sites. Hover over a link on a computer, or press and hold on a phone, to preview where it really goes before you tap.
- Requests for personal or login details. A message that leads to a page asking for your password, bank details or a code you've just received.
- Logos or design that feel slightly off. Familiar branding that doesn't look quite right.
- Spelling and grammar mistakes. Still a useful sign when present, but no longer reliable when absent.
The one every business should know: changed payment details
One of the most damaging types of scam doesn't contain a dodgy link at all. It's an email, apparently from a supplier or a senior colleague, saying bank details have changed, or asking for an urgent transfer.
The rule is simple and worth writing into your process: never change payment details or make an unusual payment based on an email alone. Call the person or company back on a number you already have — from a previous invoice, your records, or their official website — not a number in the email. If a "director" asks for an urgent transfer, a quick call to confirm costs nothing.
How to check a suspicious email safely
If something feels wrong, the NCSC and Stop! Think Fraud give the same advice:
- Don't click links, open attachments, reply or call numbers in the message.
- Contact the organisation directly using details you know are correct — their official website, a bill, the back of your bank card. For banks, you can call 159, which connects to many UK banks' fraud lines.
- Go to the website yourself by typing the address or using a bookmark, rather than following a link, and sign in there to see whether there's really a problem with your account.
How to report it
In the UK, you can forward suspicious emails to the NCSC's Suspicious Email Reporting Service at report@phishing.gov.uk. The NCSC says you can forward emails even if you're not sure they're a scam — they'll check — and that you don't need to forward messages already caught in your spam or junk folder.
You can forward suspicious text messages to 7726, a free service provided by mobile networks.
Inside your business, agree one simple rule: if in doubt, forward it to whoever handles IT and ask. Reporting a false alarm costs nothing. Staying quiet because you clicked something and feel embarrassed is what turns a small problem into a big one.
What to do if someone has already clicked
Don't panic, and don't blame. Speed matters more than anything else. The NCSC's advice depends on what happened:
- If you entered a password, change it straight away, and change it anywhere else you used the same one. Check that 2-step verification is turned on for that account.
- If you opened an attachment or installed something, disconnect the device from the network, run a full antivirus scan, and get help from your IT support.
- If you shared bank details or sent money, contact your bank immediately.
- If you've lost money or been hacked, report it. In England, Wales and Northern Ireland, report to Report Fraud at reportfraud.police.uk or on 0300 123 2040. In Scotland, contact Police Scotland on 101.
- If your organisation has had a cyber incident, the NCSC also explains how to report it for a business.
Make it easier for staff to get it right
A few habits reduce the chance of a phishing email doing real damage:
- Turn on 2-step verification for email and other important accounts, so a stolen password isn't enough on its own.
- Think about what you publish. The NCSC suggests reviewing staff profiles, biographies and other details on your website and social media that criminals could use to make scams more convincing.
- Keep devices and software updated, so a malicious attachment has fewer weaknesses to exploit.
- Talk about it. Share real examples you receive (with personal details removed) so everyone recognises the current tricks.
Where People's Digital fits
Our Business Care plan (£90/month) includes regular security and MFA checks, priority support and remote help — so when someone does click something they shouldn't, there's a team to call straight away. If you'd like help setting up safer email practices for your team, get in touch.