How to Spot and Respond to Phishing Emails

Phishing is a message, usually an email, text or call, that pretends to come from someone you trust in order to make you click a link, open a file, hand over a password or send money. To spot it, check the sender's real address, look for unexpected urgency or pressure, hover over links to see where they actually go, and be suspicious of any request to change payment details, share credentials or bypass normal process. If you suspect one, do not click, report it to your IT contact, and delete it. If you already clicked, report it immediately rather than hoping it was harmless.

Why phishing works

Phishing succeeds because it targets people, not software. It uses everyday pressures: a boss who needs something now, a delivery you are waiting for, an invoice that looks routine, a security alert that sounds scary. Attackers research targets using public information such as LinkedIn and your website, so messages can look convincing and personal. Generic spelling mistakes are a less reliable giveaway than they used to be, and text written with the help of modern tools can read perfectly well. Rely on behaviour checks rather than on how polished the writing is.

Common types

• Bulk phishing: broad messages pretending to be a bank, courier, cloud provider or tax body.
• Spear phishing: tailored to a specific person or role, often using real names and context.
• Business email compromise: impersonating a director, supplier or customer to redirect a payment or request gift cards.
• Credential harvesting: a fake login page that captures your username and password, sometimes your MFA code too.
• Malicious attachments: documents or archives designed to run harmful code.
• Smishing and vishing: the same tricks by text message or phone call, sometimes with a spoofed caller number.
• QR code phishing: a QR code that leads to a fake page, which avoids link scanners and is harder for people to judge.

Warning signs to check

Check	What to look for
Sender	The real address, not just the display name; slight misspellings of a familiar domain
Urgency	Deadlines, threats, or secrecy: "do this now and do not tell anyone"
Request	Passwords, codes, payments, changed bank details, gift cards
Links	Hover to preview the destination; the visible text may differ from the real address
Attachments	Unexpected invoices, zip files, or documents asking you to enable macros or editing
Context	Does it fit what you expect from this person or company at this time?
Tone	Out-of-character wording from a colleague or manager

What to do when you spot one

1. Do not click, open or reply.
2. Verify through a different channel. Phone the person using a number you already hold, not one in the message.
3. Report it using your company's process or a report button in your mail client, so others can be warned and the sender blocked.
4. Delete it after reporting.

What to do if you clicked or replied

Speed matters more than blame. Follow this order:

1. Tell your IT contact immediately and say exactly what you did: clicked, typed a password, opened a file, sent money.
2. If you entered credentials, change that password from a trusted device, and anywhere else you reused it. Sign out of other sessions where possible.
3. If you opened an attachment, disconnect the device from the network and wait for guidance. Do not keep working on it.
4. Check the account for forwarding rules, unfamiliar sign-ins and sent messages. Attackers often set up rules to hide replies.
5. If money was sent, contact your bank at once. Rapid action sometimes allows a recall, though there is no guarantee.
6. Assess whether personal data was exposed. A breach involving personal data may need to be reported to the Data Protection Commission within a short, defined window. This is general information and not legal advice.

Technical controls that reduce the risk

• Multi-factor authentication, ideally phishing-resistant methods such as passkeys or security keys. See our MFA rollout guide.
• Email authentication: SPF, DKIM and DMARC on your domain make it harder to spoof you.
• Mail filtering with attachment and link scanning, and warning banners on external email.
• Least privilege, so a compromised account cannot reach everything.
• Automatic updates and endpoint protection, to limit what a malicious file can do.
• Payment controls, such as a second approver and call-back verification for any change of bank details.

Building a reporting culture

The most effective defence is a workplace where reporting is quick and safe. Make reporting one click or one phone number, thank people who report, even when it turns out to be harmless, and never punish a genuine mistake that is reported promptly. When staff fear blame they hide incidents, and hours of delay can turn a small problem into a large one. Share anonymised examples of recent attempts so people see what real ones look like.

A worked example: a payment-change request

Consider a typical scenario, described generically rather than as a real case. Someone in accounts receives an email that appears to be from a regular supplier saying their bank details have changed and the next payment should go to a new account. The message is polite, references a real purchase order number, and mentions that the matter is urgent because of an audit at the supplier's end. Every one of the warning signs is present, even though nothing looks obviously fake: a request to change payment details, urgency, and a reason not to follow the usual process.

The safe response is routine rather than heroic. Do not reply to the email. Look up the supplier's phone number from your own records, not from the message, and ring to confirm the change with a person you know. Require a second person to approve any change of bank details, and record the verification. If the call shows the request was fake, report the email, warn colleagues, and check whether similar messages reached others. A process that makes this verification normal means no single employee has to judge, alone and under pressure, whether an email is genuine.

Phishing and your own customers

Criminals may also impersonate your business to your customers. Protect your brand by publishing clear guidance on how you will and will not contact customers, for example that you never ask for passwords by email. Configure your domain's email authentication so spoofed messages are more likely to be rejected, and monitor for lookalike domains that copy your name. If customers report suspicious messages, treat those reports as an early warning that something may be wrong on your side too.

Common mistakes

• Relying on spotting typos. Many modern phishing messages are well written.
• Trusting the display name. It is trivial to fake.
• Using contact details from the suspicious message to verify it.
• Training once a year and forgetting. Short, frequent refreshers stick better.
• Making staff feel stupid. That reduces reporting and increases risk.
• No payment verification rule. Fraud depends on one person acting alone under pressure.

Next steps

Agree your reporting route, tighten email authentication and payment checks, and give staff short regular guidance. Our cybersecurity checklist places phishing in the wider picture. If you want help hardening authentication and monitoring across your systems, our cybersecurity solutions cover that, and we can talk through what makes sense for your team.