Is that email real? A 30-second check.

The short answer

Phishing emails are how most attacks on businesses begin. They don't need to be clever. They just need one person, on one busy afternoon, to click a link, open a file or pay an invoice. Before you click, pay or log in, stop and check who it's really from and what it's asking you to do. If anything feels off, check it another way, not by replying.

The good news: you don't need to be technical to catch most of them. You need a habit, and a team that feels fine about asking "is this real?"

The 30-second check

Teach your team to run through these five questions before acting on any email that asks for something.

1. Who is it really from? Look at the actual email address, not just the name. "Microsoft 365" sending from a random Gmail address, or your supplier's name with one letter changed, is a giveaway.
2. Were you expecting it? An invoice you didn't ask for, a shared document from someone you haven't spoken to in months, a parcel you didn't order. Unexpected is the biggest red flag of all.
3. Is it rushing you? "Your account will be closed today", "urgent payment needed before 5pm", "I'm in a meeting, just do it". Pressure is there to stop you thinking.
4. Where does the link go? On a computer, hover over it before clicking and read the address that appears. On a phone, press and hold. If it's not the website you'd expect, don't go there.
5. What does it want? Your password, a payment, new bank details, gift cards, or a file to be opened. Those are the five things attackers are after, so treat them as a reason to slow down.

If the answer to any of these is "not sure", check it another way. Call the person on a number you already have, not one in the email. Log in by typing the website address yourself. Ask a colleague. It takes a minute, and it's the minute that matters.

The tricks working best right now

Trick	What it looks like
Fake login pages	"Your password expires today" or "You've been sent a document", linking to a page that looks exactly like Microsoft 365 or Google. Typing your password there hands it over.
Changed bank details	An email from a real supplier's account (because theirs was hacked) asking you to pay a new account. Here's what to do if you've already paid.
The boss in a hurry	A message that seems to come from a director, asking for an urgent payment or gift cards, and to keep it quiet.
QR codes	A QR code in an email or PDF, so the link can't be hovered over. Treat it like any other link.
"Approve this" requests	A pop-up or email asking you to approve an app or a sign-in you didn't start. If you didn't just try to log in, the answer is no.

Someone clicked. What now?

It happens to careful people. What matters is how fast you act, so make sure your team knows that owning up quickly is always the right call.

1. If they typed a password, change it straight away, then sign the account out of every device. In Microsoft 365, an admin can do this from the user's page.
2. If they opened a file, disconnect that computer from the network (unplug it or turn off Wi-Fi) and don't switch it off. Then get help.
3. If money was sent, call your bank immediately. The sooner they know, the better the chance of stopping it.
4. Check the mailbox for new forwarding or inbox rules you didn't create. Attackers set these up to hide what they're doing. Here's what to do if a business email is hacked.

If you think personal data was exposed, you may need to tell the ICO within 72 hours. Here's how to decide.

Make reporting easy

The best defence is a team that reports anything odd without worrying they'll look silly. A few things that help:

• Say thank you for every report, even the false alarms. If people get told off for asking, they stop asking.
• Use the Report button. Outlook has a built-in Report button for phishing. Show everyone where it is.
• Forward the rest to the NCSC. In the UK, suspicious emails can be forwarded to report@phishing.gov.uk, and scam texts to 7726. The NCSC uses them to take down scam websites.
• Share real examples. When one arrives, pass round a screenshot. Five minutes at a team meeting beats an hour-long training video.

Back it up with the right settings

People will always miss the occasional good fake, so don't rely on them alone. MFA means a stolen password isn't enough on its own. DMARC stops criminals sending email that looks like it came from your own domain. And these Microsoft 365 settings block a lot of phishing before anyone sees it. You can check your domain's email security with the free email checker.

FAQ

Do we need formal phishing training?

Short and regular beats long and annual. A ten-minute session when someone joins, then real examples shared as they arrive, works better for most businesses than a yearly course people click through. Simulated phishing tests can help, as long as they're used to teach, not to catch people out.

Does Cyber Essentials cover phishing?

Not directly as a training requirement, but its controls (secure settings, user access and malware protection) all reduce the damage a phishing email can do. Cyber Essentials is a good next step once your team has the habit.

What if the email came from a real colleague or supplier?

Their account may have been taken over, which makes the email look completely genuine. That's why the "what does it want?" check matters more than who it's from. If it's asking for a payment, a password or new bank details, check by phone.

Should I reply to ask if it's genuine?

No. If the account has been taken over, the attacker will reply and say yes. Always check another way.