Knowing how to spot a phishing email helps your team pause before handing over a password, opening an unexpected file or approving a false payment. A convincing message may use a familiar logo, a colleague’s name or a genuine email conversation. Check what it asks you to do, then verify unusual requests through a separate channel.
This guide gives small businesses a repeatable check for everyday email. It also explains how to report suspicious messages and what to tell your IT support team if someone has already responded.
How to spot a phishing email before you act
Phishing messages try to steer you towards an action that benefits the sender. The NCSC’s guidance on spotting scams describes warning signs such as pressure, impersonation and requests that seem unusual. Treat these as reasons to stop and verify, rather than a test that can prove a message is safe.
- Check the request: were you expecting this invoice, document or account warning?
- Check the sender: expand the address instead of relying on the display name. A familiar name alone proves little.
- Notice the pressure: demands for secrecy or immediate action deserve a separate check.
- Use your usual route: open the service through a saved bookmark or its official app instead of the message’s link.
- Check QR codes too: a code can lead to a fraudulent website just as a clickable link can.
For example, an unexpected “shared document” may arrive while you are waiting for a supplier quote. That timing can make it seem relevant. Ask the supplier about the document using contact details you already hold.
Why a familiar name or tidy email is not enough
Professional wording and branding do not establish who sent a message. The government’s Stop! Think Fraud email guide explains how messages can imitate organisations you already know. A request deserves checking even when it has no spelling mistakes.
A real business mailbox can also be compromised. That means the address may be correct while the request is fraudulent. Pay particular attention when a normal conversation suddenly introduces a different bank account, an unfamiliar login page or a request for a security code.
Make this distinction clear in staff briefings: spotting an odd address is useful, but an ordinary-looking address is not approval to proceed.
Check invoice and bank-detail changes separately
Consider this example: a supplier emails an amended invoice just before your payment run. The amount and order reference match your records, but the bank details have changed. Your next step should be a verification call using the number in your existing supplier record.
For your own payment process, agree these steps in advance:
- Pause the change and leave the existing supplier record intact.
- Ask a known contact to confirm the request through a separate channel.
- Record who checked it, how they contacted the supplier and what was confirmed.
- Use your normal approval process before changing the record or releasing payment.
A colleague covering annual leave should be able to follow the same steps. Put the instructions where finance staff can find them without searching old email threads. This is a practical workflow example; adapt it to your business’s payment controls.
Report a suspicious email in the UK
Tell your IT contact using your agreed reporting route. Avoid circulating a suspicious attachment around the team as a warning. Include the sender, subject and approximate arrival time, and explain whether anyone opened a link or file.
GOV.UK advises forwarding suspicious emails to report@phishing.gov.uk. Follow your organisation’s handling rules for messages containing confidential information. Reporting an email does not, by itself, recover an account or investigate an affected computer.
What to do if someone has already clicked
Report it promptly and describe exactly what happened. Opening a link, typing a password, approving a sign-in and running a downloaded file are different events. Your IT team needs that detail to decide what to contain and investigate.
If you entered credentials, use a trusted device and the service’s official route to secure the account with your administrator. Do not return through the suspicious email. For Microsoft 365, a password change may be only one part of the response. Microsoft’s compromised-account guidance covers blocking access, revoking sessions and checking mailbox forwarding, rules and other changes.
If a file ran or the device behaves unexpectedly, stop using it for sensitive work and contact IT immediately. Avoid deleting evidence or attempting a reset before receiving instructions. Use your bank’s trusted contact route immediately if a fraudulent payment may have been made.
KByte’s IT helpdesk service provides a route to discuss an affected account or device. Explain the events and timing without sending passwords or security codes.
Give your team a process they can repeat
A useful briefing should answer three questions: who do we tell, where do we report it, and what do we do while waiting? Nominate a backup contact for holidays. Encourage early reporting, including when someone is unsure or has made a mistake.
The NCSC recommends several layers of phishing defence. Staff awareness should sit alongside appropriate account protection, email controls and a response process. Review those controls as people and systems change. Our Microsoft 365 offboarding checklist covers the separate task of removing access when staff leave.
For help reviewing your setup, see KByte’s cyber security support or discuss your email security with us. Consultancy is always free. Any implementation or recovery work is scoped and quoted separately.