Phishing emails try to trick staff into clicking a bad link, opening a malicious file or paying a fake invoice. Small businesses are common targets because they have fewer defences. This checklist helps your team spot the signs.
Red flags to check
- The sender address. Look at the full address, not just the display name. A near-miss domain such as a swapped letter is a classic trick.
- Urgency or threats. “Pay today or your account closes” is meant to stop you thinking.
- Unexpected requests. Be careful with requests to change bank details, buy gift cards or share passwords.
- Links that do not match. Hover over a link to see where it really goes before clicking.
- Unexpected attachments. Be careful with invoices, voicemail or shared-document messages you were not expecting.
- Poor or odd wording. This is less reliable now that criminals use AI to write polished messages, so check the other signs too.
Fake invoice and payment change fraud
A common scam is an email that appears to come from a supplier or your boss asking you to pay a new bank account. Always confirm bank detail changes by phone using a number you already hold, not one in the email.
What to do if someone clicks
- Disconnect the device from the network if you can.
- Change the passwords of any account the person entered, starting with email.
- Check that multi-factor authentication is on.
- Tell your IT support or the business owner straight away.
- Run a security scan and watch for strange activity on accounts.
Reporting scams in the UK
- Forward suspicious emails to the National Cyber Security Centre at report@phishing.gov.uk.
- If you lost money, report it through the UK national fraud reporting service and tell your bank straight away.
Reduce the risk
- Turn on MFA everywhere.
- Use a password manager, which will not auto-fill on fake sites.
- Keep software updated and keep backups.
- Run a short staff briefing every few months.
Frequently asked questions
Can antivirus stop phishing?
It helps with malicious files and sites but cannot stop a person being tricked, which is why training matters.
How often should I train staff?
A short reminder every few months works better than one long session a year.
Want help hardening your email and accounts? See our IT setup services.
Disclosure: some links on this site are affiliate links. If you buy through them we may earn a commission at no extra cost to you. This does not change what we recommend. Read our affiliate disclosure.
