Phishing: how to spot it and stop it

Phishing is when someone pretends to be a person or company you trust, to get you to click, log in or pay. It is still the easiest way into most businesses, because it targets people, not software.

What it looks like now

The badly spelled “Nigerian prince” email still exists, but modern phishing is far more convincing:

• Fake sign-in pages. An email that appears to come from Microsoft 365, DocuSign or a shared file service, leading to a login page that looks genuine
• Invoice and payment fraud. A message that looks like it comes from your finance director or a supplier, asking you to pay a new account
• Quishing. QR codes in emails or on posters that take you to a malicious site
• Text and call attacks. Text messages (smishing) and phone calls (vishing) that create urgency
• AI-written messages. Fluent, personalised and free of the usual spelling mistakes

You can no longer rely on poor grammar as the clue.

Warning signs

Teach people to pause when a message does any of these:

1. Creates urgency or fear. “Your account will be closed in an hour”
2. Asks for something unusual. A gift-card purchase, a change of bank details, a password
3. Comes from an address that is slightly off. The display name is right, but the address behind it is not
4. Contains a link or attachment you were not expecting
5. Asks you to bypass your normal process

The best habit is to verify through a different channel. If the “boss” asks for an urgent payment, ring them on a number you already have.

Technical controls

Training matters, but do not rely on people alone. Layers help:

• Multi-factor authentication on everything. Even if a password is stolen, the attacker still needs the second factor. Phishing-resistant methods are better still; see our guide to passkeys for business.
• Email filtering that checks links and attachments before they reach inboxes
• SPF, DKIM and DMARC on your domain, which make it harder for criminals to send email pretending to be you
• Up-to-date devices with endpoint protection, so a malicious file is less likely to run. See EDR vs antivirus.
• Conditional access and device checks to limit what stolen credentials can do
• Clear external-email banners so people can see when something comes from outside

Training that works

• Keep sessions short and regular, not one annual lecture
• Use real, recent examples
• Run simulated phishing exercises, and treat clicks as learning, not blame. Depending on your Microsoft 365 plan, simulation tools may already be included.
• Celebrate people who report suspicious messages

If staff fear being punished, they will hide mistakes, and you lose the precious minutes you need to react.

Make reporting easy

Give everyone a single, simple way to report a suspicious email, such as a “report phishing” button in Outlook. You can also forward suspicious emails to the NCSC at [email protected], which helps take down scam sites.

If someone clicks

Speed matters. Tell staff to:

1. Not panic, and not stay quiet. Report it immediately
2. Disconnect the device from the network if they opened an attachment or approved a sign-in prompt
3. Change the password from a different, clean device if they typed credentials
4. Let IT know so accounts can be locked, sessions revoked and mail rules checked

Attackers often create hidden inbox rules to forward or delete messages, so IT should check for these. The first hour of an incident matters, so we have written down what to do.

Part of a bigger picture

Phishing defences are a core part of any security programme and a requirement of schemes like Cyber Essentials. Our cyber security hub shows how training, technology and planning fit together.

Would you like help with email protection, user training or a simulation exercise? Talk to us about cyber security.