Phishing emails: how to spot them and what to do

Phishing is the attack UK businesses face most often. Here's how to spot it, what to do if someone clicks, and how to report it.

What phishing is

Phishing is a scam message, usually an email but sometimes a text or call, that pretends to come from someone you trust. It tries to get you to click a link, open an attachment, enter your password, or make a payment.

It's the most common attack by far. In the government's 2025/26 Cyber Security Breaches Survey, 38% of UK businesses reported phishing in the past year. Of the businesses that had a breach or attack, 69% said phishing was the most disruptive kind.

Warning signs

• Urgency or pressure: "Your account will be closed today", or "Pay this invoice before 5pm".
• A request to change bank details for a supplier or a member of staff. Always check by phone, using a number you already have.
• A sender that's slightly off: a misspelt domain, or a display name that doesn't match the actual email address.
• Unexpected attachments or links, especially "shared documents" or "voicemail messages".
• A login page asking for your Microsoft 365 or Google password after you've clicked a link.
• Something that just feels odd, such as the boss emailing from a personal address or asking for gift cards.

Phishing emails are getting more convincing, so don't rely on spotting spelling mistakes. Check anything involving money or passwords by another route.

If someone has clicked

1. Don't panic, and don't hide it. Fast reporting limits the damage, so make it easy for staff to own up.
2. If a password was entered, change it straight away, along with anywhere else the same password is used.
3. Check that multi-factor login is turned on for that account, and look for unfamiliar sign-ins or email forwarding rules.
4. If an attachment was opened, disconnect the device from the network and get IT help.
5. If money was sent, call your bank immediately.

How to report it

• Emails: forward suspicious emails to report@phishing.gov.uk, the NCSC's Suspicious Email Reporting Service.
• Texts: forward them to 7726. It's free.
• If you've lost money or data, report it to the police's fraud and cyber crime service at reportfraud.police.uk.

Protecting your business

• Turn on multi-factor login. It stops most stolen passwords from being useful.
• Agree a simple rule: no payment or bank-detail change without a phone check.
• Give staff a short refresher a couple of times a year, and praise people who report.
• Keep devices and browsers updated, and keep malware protection switched on.

How this connects to Cyber Essentials

Cyber Essentials won't stop phishing emails arriving, but its controls limit what a successful phish can do: multi-factor login on cloud services, up-to-date software, malware protection and separate admin accounts.