# How to spot a phishing email in your small business > Check suspicious emails, verify payment requests and give your team a clear reporting process. Practical guidance for UK small businesses. Language: British English (en-GB). Canonical page: https://kbyte.co.uk/how-to-spot-a-phishing-email/ Last updated: 2026-10-21 Knowing how to spot a phishing email helps your team pause before handing over a password, opening an unexpected file or approving a false payment. A convincing message may use a familiar logo, a colleague’s name or a genuine email conversation. Check what it asks you to do, then verify unusual requests through a separate channel. This guide gives small businesses a repeatable check for everyday email. It also explains how to report suspicious messages and what to tell your IT support team if someone has already responded. ## How to spot a phishing email before you act Phishing messages try to steer you towards an action that benefits the sender. The [NCSC’s guidance on spotting scams](https://www.ncsc.gov.uk/collection/phishing-scams/spot-scams) describes warning signs such as pressure, impersonation and requests that seem unusual. Treat these as reasons to stop and verify, rather than a test that can prove a message is safe. - **Check the request:** were you expecting this invoice, document or account warning? - **Check the sender:** expand the address instead of relying on the display name. A familiar name alone proves little. - **Notice the pressure:** demands for secrecy or immediate action deserve a separate check. - **Use your usual route:** open the service through a saved bookmark or its official app instead of the message’s link. - **Check QR codes too:** a code can lead to a fraudulent website just as a clickable link can. For example, an unexpected “shared document” may arrive while you are waiting for a supplier quote. That timing can make it seem relevant. Ask the supplier about the document using contact details you already hold. ## Why a familiar name or tidy email is not enough Professional wording and branding do not establish who sent a message. The government’s [Stop! Think Fraud email guide](https://stopthinkfraud.campaign.gov.uk/how-to-spot-fraud/how-to-spot-a-phishing-email/) explains how messages can imitate organisations you already know. A request deserves checking even when it has no spelling mistakes. A real business mailbox can also be compromised. That means the address may be correct while the request is fraudulent. Pay particular attention when a normal conversation suddenly introduces a different bank account, an unfamiliar login page or a request for a security code. Make this distinction clear in staff briefings: spotting an odd address is useful, but an ordinary-looking address is not approval to proceed. ## Check invoice and bank-detail changes separately Consider this example: a supplier emails an amended invoice just before your payment run. The amount and order reference match your records, but the bank details have changed. Your next step should be a verification call using the number in your existing supplier record. For your own payment process, agree these steps in advance: - Pause the change and leave the existing supplier record intact. - Ask a known contact to confirm the request through a separate channel. - Record who checked it, how they contacted the supplier and what was confirmed. - Use your normal approval process before changing the record or releasing payment. A colleague covering annual leave should be able to follow the same steps. Put the instructions where finance staff can find them without searching old email threads. This is a practical workflow example; adapt it to your business’s payment controls. ## Report a suspicious email in the UK Tell your IT contact using your agreed reporting route. Avoid circulating a suspicious attachment around the team as a warning. Include the sender, subject and approximate arrival time, and explain whether anyone opened a link or file. [GOV.UK advises forwarding suspicious emails to report@phishing.gov.uk](https://www.gov.uk/report-suspicious-emails-websites-phishing/report-internet-scams-and-phishing). Follow your organisation’s handling rules for messages containing confidential information. Reporting an email does not, by itself, recover an account or investigate an affected computer. ## What to do if someone has already clicked Report it promptly and describe exactly what happened. Opening a link, typing a password, approving a sign-in and running a downloaded file are different events. Your IT team needs that detail to decide what to contain and investigate. If you entered credentials, use a trusted device and the service’s official route to secure the account with your administrator. Do not return through the suspicious email. For Microsoft 365, a password change may be only one part of the response. [Microsoft’s compromised-account guidance](https://learn.microsoft.com/en-us/defender-office-365/responding-to-a-compromised-email-account) covers blocking access, revoking sessions and checking mailbox forwarding, rules and other changes. If a file ran or the device behaves unexpectedly, stop using it for sensitive work and contact IT immediately. Avoid deleting evidence or attempting a reset before receiving instructions. Use your bank’s trusted contact route immediately if a fraudulent payment may have been made. KByte’s [IT helpdesk service](https://kbyte.co.uk/it-support-helpdesk-services/) provides a route to discuss an affected account or device. Explain the events and timing without sending passwords or security codes. ## Give your team a process they can repeat A useful briefing should answer three questions: who do we tell, where do we report it, and what do we do while waiting? Nominate a backup contact for holidays. Encourage early reporting, including when someone is unsure or has made a mistake. The [NCSC recommends several layers of phishing defence](https://www.ncsc.gov.uk/guidance/phishing). Staff awareness should sit alongside appropriate account protection, email controls and a response process. Review those controls as people and systems change. Our [Microsoft 365 offboarding checklist](https://kbyte.co.uk/microsoft-365-employee-offboarding-checklist/) covers the separate task of removing access when staff leave. For help reviewing your setup, see KByte’s [cyber security support](https://kbyte.co.uk/cyber-security/) or [discuss your email security with us](https://kbyte.co.uk/contact/). Consultancy is always free. Any implementation or recovery work is scoped and quoted separately.