How to Spot a Phishing Email: A Jargon-Free Guide for UK Small Businesses

Phishing emails are designed to look believable. A message might appear to come from a supplier, a colleague, your bank or a government service. It may ask you to open an attachment, sign in to an account or make a payment.

The aim is to get you to act before you stop to check. That can put business accounts, money and customer information at risk.

The latest UK Cyber Security Breaches Survey found that 38% of businesses had experienced phishing in the previous 12 months. It remains the most commonly reported type of cyber attack.

The good news is that a simple pause-and-check habit can help your team avoid many common traps. Here is what to look for and what to do next.

What is a phishing email?

A phishing email is a fraudulent message that tries to trick someone into sharing information, sending money, opening a harmful file or visiting a fake website.

Scammers often pretend to be a trusted person or organisation. They may copy familiar branding or refer to a real order, invoice or service. Some messages are sent to many people. Others are tailored to a particular business or employee.

The National Cyber Security Centre (NCSC) warns that phishing can be used to steal login or bank details, access business or customer information, or take over email accounts.

How to spot a suspicious email

One sign alone does not prove that an email is a scam. Look at the whole message and check whether its request makes sense.

1. Check the full sender address

The sender's display name can be misleading. An email that appears to come from a familiar supplier may use a different address when you look closely.

Check for:

• A misspelling in the organisation's name
• Extra words, numbers or punctuation
• A different domain after the @ symbol
• An address that does not match previous messages

If the request is unusual, do not rely on a familiar name or logo as proof.

2. Be cautious of urgency or pressure

Scammers want you to act quickly, before you can verify the request. The email might say that an account will be closed, a payment is overdue or a service will stop unless you respond immediately.

Treat pressure as a reason to pause. A real deadline can still be checked through a separate, trusted route.

3. Look closely at links and attachments

A message may ask you to sign in, view a document or download an invoice. The link text might look legitimate while the destination leads somewhere else.

• Don't click a link to see where it goes.
• If your email service offers a safe link preview, inspect the destination without opening it.
• Don't open unexpected attachments, even if they appear to relate to work.
• Be especially wary of unexpected requests to sign in or enable macros.

When in doubt, go to the organisation's official website yourself or contact your IT support.

4. Notice requests that break normal process

An email asking for a password, payment, gift card, bank-detail change or login code deserves extra scrutiny. This is especially true when the request appears to come from a senior colleague or regular supplier.

For payments and bank-detail changes, verify the request with a known contact using a separate channel. Use a phone number you already have on record, not one provided in the email.

5. Don't rely on spelling mistakes

Spelling errors and awkward wording can be clues, but polished writing does not mean a message is safe. Scam emails can look professional and may copy familiar branding.

Pay more attention to the sender, the request, the links and whether the message fits your usual business process.

A simple way to check an email

Use this three-step routine whenever a message feels unexpected or unusual:

1. Pause. Don't click, reply, pay or open an attachment.
2. Check. Review the sender and request. Verify it using contact details you already trust.
3. Report. Tell the right person in your business and report the message if it looks suspicious.

This is more useful than asking staff to memorise every possible sign of a scam. The aim is to build a habit of checking before acting.

What to do if someone has clicked

Mistakes happen. If you or a colleague clicked a link, opened an attachment or entered information, act promptly. Don't wait to see whether anything appears to have gone wrong.

• Tell your IT support or whoever manages your systems.
• If you entered a password, change it using the official service, and change it anywhere else you reused it.
• If you shared banking details or made a payment, contact your bank immediately.
• If a work device may be affected, follow your IT provider's instructions. Avoid using it for sensitive work until they have checked it.
• Keep the email and note what happened, including when and what information was shared.

If you have lost money or believe your business has been hacked, report the incident to Action Fraud in England, Wales or Northern Ireland. In Scotland, contact Police Scotland on 101. The NCSC also advises contacting your bank if you have shared financial information.

Report suspicious emails, even if you are unsure

You can forward suspicious emails to the NCSC's Suspicious Email Reporting Service at report@phishing.gov.uk. The NCSC says it analyses reported emails and may work to remove malicious websites. You do not need to be certain that a message is a scam before reporting it.

Make sure your team knows who to contact internally too. That could be your IT provider, manager or nominated security contact. A clear reporting route helps the business respond quickly and can help protect colleagues who receive the same message.

Make phishing awareness part of everyday work

Good security is not about blaming staff for a convincing scam. It is about making it easier to check, report and recover.

Practical steps include:

• Share examples of suspicious messages and discuss what made them unusual.
• Agree how staff should verify payment requests and bank-detail changes.
• Make it clear that staff can report a message without fear of blame.
• Use multi-factor authentication, which adds a second check when someone signs in.
• Keep software and devices updated.
• Write down who to contact if a message has been clicked or information shared.

The NCSC's small organisations guide offers further practical advice. For a broader baseline, Cyber Essentials focuses on core technical controls that help protect against common online threats.

One practical step to take today

Send your team a short note with three instructions: pause, check, report. Include the name of your internal contact and agree how staff can verify payment or account requests using a separate, trusted channel.

If you want help turning good practice into a manageable plan, SimpleCyber can help. We bring more than 20 years of hands-on experience, with practical support for Cyber Essentials and flexible Virtual CISO services. Get in touch for a straightforward conversation about what your business needs.