Why phishing works
Phishing doesn't beat your technology; it persuades a person. Attackers copy brands you trust, invent urgency and catch people when they're busy. AI has made their emails better written. Spelling mistakes are no longer a reliable giveaway, so look at behaviour, not grammar.
The 12 red flags
- Urgency or threat. "Your account will be closed today." "Payment overdue — legal action." Pressure is the attacker's best tool.
- A request to log in from a link. Microsoft, your bank or HMRC asking you to "verify" via a link. Go to the site yourself instead.
- The sender address doesn't match. The display name says "Microsoft 365", but the address is m365-support@outlook-secure.net. Tap or hover to see the real address.
- Lookalike domains. rnicrosoft.com (r-n, not m), paypa1.com, or your own company name with an extra letter.
- Unexpected attachments, especially invoices, "remittance advice", voicemails, ZIP files or HTML files.
- Links that don't go where they say. Hover over the link (or long-press on mobile) and read the real web address before clicking.
- QR codes in emails or PDFs ("scan to review document"). These are designed to move you onto your phone, away from your company's protections.
- Changed bank details. Any email changing where you should send money is high-risk. See invoice fraud.
- Requests to keep it secret or bypass the normal process. "I'm in a meeting, just get it done."
- Gift card requests. No genuine boss needs you to buy gift cards urgently.
- Unexpected MFA prompts. If your phone asks you to approve a sign-in you didn't start, someone has your password. Deny it and tell IT.
- A sign-in page that looks slightly off after clicking a link, or that asks for your password again unexpectedly.
It's not just email
The same tricks arrive by text ("smishing"), phone ("vishing"), Teams and WhatsApp messages, and fake social media profiles. AI voice cloning means a call that sounds like your MD isn't proof that it's them. The red flags are identical: urgency, secrecy, money, logins.
Clicked? Do this now
- Don't panic, and don't hide it. Tell IT immediately. Minutes matter.
- If you entered a password, change it from a different, trusted device, and change it anywhere else you used it.
- If you approved an MFA prompt, say so. IT can sign the attacker out of every session.
- If you opened an attachment, disconnect the device from Wi‑Fi and the network, but leave it switched on for IT to investigate.
- If money moved, call your bank now.
More detail: what to do in the first hour after a cyber attack.
How businesses reduce the risk
- MFA on every account. See our MFA guide.
- Email filtering, plus SPF, DKIM and DMARC on your domain
- A "Report phishing" button in Outlook
- Short, regular awareness training and simulated phishing
- A no-blame culture, so people report mistakes quickly
How to report it in the UK
- Suspicious email: forward it to report@phishing.gov.uk (the NCSC's Suspicious Email Reporting Service), then delete it.
- Scam text message: forward it to 7726.
- Lost money or data: contact your bank immediately (dial 159 to reach most UK banks safely), then report to Report Fraud at reportfraud.police.uk or on 0300 123 2040. Report Fraud replaced Action Fraud in December 2025.
- Inside your business: tell your IT contact straight away, even if you clicked. Speed matters far more than blame.
