How to spot a phishing email
The signs to look for, the two rules that stop nearly every attack, and exactly what to do if you have already clicked.
Modern phishing emails are well written and often copy a real company perfectly. Spelling mistakes are no longer the giveaway — these checks are.
-
Check the real sender address
The display name is free text and can say anything. Click or hover on it to see the actual address. "Microsoft Support" sending from a random Gmail or a lookalike domain such as micros0ft-billing.com is your answer.
-
Hover over links before clicking
On a computer, hover over the button and read the address that appears at the bottom of the window. On a phone, press and hold. If it does not go to the organisation it claims to be from, it is not from them.
-
Notice the urgency
Almost every scam creates time pressure: your account will be closed, a payment has failed, the invoice is overdue. Genuine organisations do not give you twenty minutes to act.
-
Be suspicious of changed bank details
Invoice redirection fraud is the most costly attack on small businesses. Any email saying a supplier has changed bank details must be verified by phoning a number you already had — never one from the email.
Tip: Make this a written company rule. It removes the pressure on staff to make a judgement call.
-
Log in the way you normally would
If you are unsure whether a message is real, do not use its link. Open a browser and go to the site yourself, or use the app. Anything genuine will be waiting for you in your account.
-
If you have already clicked
Change the password for that account immediately from a different device, turn on multi-factor authentication, and check your email rules for a new rule forwarding or deleting messages — attackers add these to hide their activity. Then tell your IT support, even if you feel daft.
Common questions
Where do I report it?
Forward suspicious emails to report@phishing.gov.uk, and report text messages by forwarding to 7726. If money has been lost, contact your bank immediately and report it to Action Fraud.