Phishing is no longer limited to badly written emails promising an unlikely prize. A convincing message can copy a supplier, director, bank or Microsoft 365 sign-in page and arrive by email, text, social media or phone. The safest response is a repeatable process that helps people pause, verify and report.
What should make you suspicious?
- Unexpected urgency: pressure to pay, sign in or share information immediately.
- A changed request: a supplier provides new bank details or a colleague asks for gift cards.
- A misleading sender: the display name looks right but the address or domain does not.
- An unusual link: the destination differs from the organisation’s real website.
- An unexpected attachment: especially a file asking you to enable macros or bypass a warning.
- A request for secrets: passwords, one-time codes and recovery codes should not be shared.
A safe way to verify a message
Do not reply using the contact details in the suspicious message. Contact the person or organisation through a trusted number, saved contact or known website. For payment changes, use a second channel and an established approval process. Open important services from a bookmark rather than from an email link.
Hovering over a link can expose an obvious fake, but a plausible-looking address can still be malicious. If in doubt, do not open it. Send the message to your IT or security team using the organisation’s reporting process.
Controls that reduce the damage
- Enable multifactor authentication, particularly for email, finance and administrative accounts.
- Use a password manager so each service has a unique password.
- Protect email with appropriate anti-phishing controls and domain authentication.
- Restrict administrator rights and use separate accounts for privileged work.
- Train staff with realistic examples and make reporting simple and blame-free.
- Use payment verification and dual approval for high-risk transactions.
The UK National Cyber Security Centre provides current guidance on phishing and suspicious messages.
What to do if someone clicks
Act quickly, but preserve evidence. Disconnect a device if malware may have run, contact your IT team, change the affected password from a known-clean device and revoke active sessions. If credentials were entered, check mailbox rules, forwarding, sign-in history and connected applications. Tell the bank immediately if money may have been sent.
Do not simply delete the message and carry on. Other people may have received it, and the account may already be compromised. If an incident is active, use our cyber incident recovery service. For preventative help, explore our managed cyber security services.
Ready for a clearer technology plan?
Tell us what is slowing your organisation down. We will help you identify the practical next step.
