--- title: 'How to Spot a Phishing Email: A Guide for Staff' url: 'https://triplepoint.org.uk/guides/how-to-spot-a-phishing-email' markdown: 'https://triplepoint.org.uk/guides/how-to-spot-a-phishing-email.md' date: '2026-10-28' description: 'The tell-tale signs of a phishing email, real-world examples and a short checklist to share with your staff. Written for UK small businesses.' --- # How to Spot a Phishing Email: A Guide for Staff ![](https://triplepoint.org.uk/user/pages/guides/how-to-spot-a-phishing-email/how-to-spot-a-phishing-email.jpg) **To spot a phishing email, look at what it asks you to do, not how it looks: be wary of any unexpected message that creates urgency, claims authority, asks you to sign in, open an attachment, pay something or change bank details, or comes from an address that doesn't quite match the sender's name.** If in doubt, don't click. Check with the sender using contact details you already have, and report it. ## How common is phishing? In the government's [Cyber Security Breaches Survey 2025/26](https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026), **phishing was by far the most common attack, experienced by 38% of UK businesses in the previous 12 months**, and the most disruptive for 69% of businesses and charities that had a breach or attack. Yet only **22% of businesses had tested their staff**, for example with practice phishing emails, and 58% had an agreed process for staff to follow when they find a fraudulent email. That last figure matters most. Every member of staff should know what to do with a suspicious email, and this guide is written so you can share it with them. ## The signs to look for The NCSC's [advice on spotting scams](https://www.ncsc.gov.uk/collection/phishing-scams/spot-scams) highlights the tricks criminals use to rush you. Look out for: - **Authority.** It claims to be from someone official or important: your bank, HMRC, Microsoft, your IT team or your own boss. - **Urgency.** "Within 24 hours", "your account will be closed", "needs paying today". Pressure is designed to stop you thinking before you act. - **Emotion.** It makes you worried, curious or excited: a missed delivery, an unpaid invoice, a pay rise, a refund. - **Something you weren't expecting.** A shared document you didn't ask for, a password reset you didn't request, an invoice from a company you don't use. Then check the details: - **The sender's full address.** The name might say a colleague or a supplier, but the address behind it may be a free webmail account or a look-alike domain, one letter different from the real one. - **Where the link really goes.** On a computer, hover over a link without clicking to see the real address. If it isn't the website you'd expect, don't click. - **A sign-in page you arrived at from an email.** Fake Microsoft 365 and Google sign-in pages look identical to the real thing. Go to the site yourself, from a bookmark or by typing the address, instead. - **Attachments you weren't expecting,** especially ones that ask you to "enable content" or open a link to view a document. - **QR codes in emails.** Scanning one moves the link to your phone, where it's harder to check and often outside your company's protection. - **Requests to change bank details or keep something confidential.** These are the hallmarks of [invoice fraud](https://triplepoint.org.uk/guides/invoice-fraud-business-email-compromise), and always worth a phone call. ## Common examples Phishing emails change all the time, but most are variations on a few themes: - **"A document has been shared with you."** A link to a fake sign-in page that captures your password, and often your sign-in code too. - **"Your password expires today"** or "unusual sign-in activity". Supposedly from IT, Microsoft or Google, with a button to "keep your password". - **"Your parcel couldn't be delivered."** A small fee to pay or a link to rearrange delivery. - **"Please find the attached invoice"** or "our bank details have changed". Sometimes from a supplier's real account that has been hacked, even in an existing email conversation. - **"Are you at your desk? I need a quick favour."** Apparently from a director, leading to a request for gift cards or an urgent payment. ## What to do with a suspicious email 1. **Don't click, open or reply.** Leave links, attachments and QR codes alone. 2. **Check with the sender another way.** Phone them on a number you already have, or message them on a channel you already use. Never use contact details from the suspicious email. 3. **Report it inside your business.** Use your report phishing button if you have one, or tell whoever looks after your IT. One person's report can protect everyone else who received the same email. 4. **Report it to the NCSC.** Forward the email to . The NCSC says it had removed 454,800 scam web addresses as of July 2026. 5. **Then delete it.** ## If you've already clicked Don't panic, and don't keep it to yourself. Tell whoever looks after your IT straight away, and tell them exactly what you did: clicked a link, entered a password, opened an attachment or approved a sign-in prompt. Speed matters far more than embarrassment. If you entered your password, change it from a different device you trust and expect your IT team to sign your account out of every session. Our guide to [what to do when a Microsoft 365 account is hacked](https://triplepoint.org.uk/guides/microsoft-365-account-hacked) has the full steps, including for Google Workspace. If you made a payment, call your bank immediately. ## A checklist to share with your staff Copy this into an email or print it out: - **Stop.** Was I expecting this? Is it trying to rush me, scare me or tempt me? - **Check the sender.** Does the full email address match who it claims to be? - **Check the link.** Hover before you click. If in doubt, go to the website yourself. - **Never** sign in, pay, change bank details or share a code because an email asked you to, without checking first by phone. - **Report it,** even if you're not sure, and even if you've already clicked. You won't be in trouble. ## For managers: make it easy to get right The NCSC's [phishing guidance for organisations](https://www.ncsc.gov.uk/guidance/phishing) warns that defences often "place too much emphasis on users being able to spot phishing emails". Some will always get through, so staff awareness works best as one layer among several: - **Stop most phishing before it arrives** with [email security](https://triplepoint.org.uk/security/people-and-email/email-security), plus SPF and DMARC records so criminals can't easily send email as your domain. - **Limit the damage of a click** with multi-factor authentication on every account, ideally phishing-resistant sign-in such as passkeys, and up-to-date devices. - **Make reporting quick and blame-free.** A one-click report button, and a thank-you for every report, including from people who clicked. - **Practise.** [Phishing simulation and training](https://triplepoint.org.uk/security/people-and-email/phishing-simulation) sends staff realistic, harmless practice emails and gives anyone who clicks short training on what they missed. Check with HR before you start, and measure how many people report, not just how many click. Our guide, [Is phishing simulation worth it?](https://triplepoint.org.uk/guides/phishing-simulation-small-business), explains how to run it fairly. If you'd like help putting those layers in place, [talk to us](https://triplepoint.org.uk/contact?about=Phishing). ## Questions Can I still spot phishing by the spelling mistakes?+Unfortunately not as a lot of phishing tools now use AI to create sophisticated and correctly spelt content. Check what the email wants you to do, and where its links really go, rather than how well it's written. Is it dangerous just to open a phishing email?+Opening and reading an email is very unlikely to harm your computer on its own. The danger is in clicking its links, opening its attachments, scanning its QR codes, or replying. If you're unsure, don't do any of those, and report it. What about scam texts and phone calls?+The same signs apply: someone claiming authority, urgency, and a request to click, pay or share a code. Forward scam texts free to 7726. If a caller asks for a password, a sign-in code or a payment, hang up and call back on a number you already know. Should staff be punished for clicking?+No. The NCSC is clear that people who fear reprisals won't report mistakes promptly, if at all, and a quick report is what limits the damage. Thank people for reporting, especially when they've clicked. It's more important that you know it's happened so you can do something about it. Where to go next- [Phishing simulation & training](https://triplepoint.org.uk/security/people-and-email/phishing-simulation) - [Email security](https://triplepoint.org.uk/security/people-and-email/email-security) - [Invoice fraud: how business email compromise works and how to stop it](https://triplepoint.org.uk/guides/invoice-fraud-business-email-compromise) - [Microsoft 365 account hacked? What to do next](https://triplepoint.org.uk/guides/microsoft-365-account-hacked) [< Back to Guides](https://triplepoint.org.uk/guides) ## Not sure what you need? Tell us a little about your business and we'll recommend the controls that will work best for you, with no obligation and no jargon. [Talk to us](https://triplepoint.org.uk/contact) or [See every security area](https://triplepoint.org.uk/security) Our experts spent 20 years at Sophos and include a certified ethical hacker. [More about us](https://triplepoint.org.uk/about) --- ## Navigation - Parent: [Cyber Security Guides for UK Small Businesses](https://triplepoint.org.uk/guides.md) - Previous: [Does a Small Business Still Need a Firewall?](https://triplepoint.org.uk/guides/does-a-small-business-need-a-firewall.md) - Next: [Incident Response Plan for a Small Business (UK)](https://triplepoint.org.uk/guides/incident-response-plan-small-business.md)