12 Quick Checks to Expose a Phishing Scam

Phishing is a form of social engineering in which an attacker sends a fraudulent message — usually email, but also SMS (smishing), phone calls (vishing) or chat — that impersonates a trusted organisation or colleague in order to trick the recipient into revealing credentials, approving a payment, opening a malicious attachment or clicking a link to a fake website. It remains the most common initial access method used against UK SMEs.

Check the sender's full email address for lookalike domains, hover over links to reveal the real destination, treat urgency and threats as a warning sign, be suspicious of generic greetings, and never trust an unexpected attachment. If the message asks you to log in, confirm bank details, change payment instructions or buy gift cards, verify it by contacting the sender through a number or address you already hold — never the details in the message.

Do not enter any further information. Disconnect the device from the network if you downloaded a file, change the password for any account whose credentials you entered, and enable or re-check multi-factor authentication on that account. Report it immediately to your IT or cyber security provider so mailbox rules, sign-in logs and endpoint alerts can be reviewed — early reporting is usually the difference between a near-miss and a full incident.

Hover over the link on desktop, or press and hold on mobile, to reveal the true destination. Read the domain from right to left — the part immediately before the first single slash is the real site. Watch for lookalike spellings, extra words bolted onto a brand name, unfamiliar country extensions and link shorteners that hide the destination. When in doubt, type the organisation's address into the browser yourself instead of clicking.

Treat any unexpected attachment as suspicious, especially executable and script types (.exe, .js, .scr, .iso, .hta), macro-enabled Office files (.docm, .xlsm), password-protected archives that bypass scanning, and HTML files that open a fake login page locally. A PDF or invoice from a supplier you did not expect is also a common delivery route for credential theft and ransomware.

Social engineering is the manipulation of people rather than technology — exploiting authority, urgency, curiosity, fear and helpfulness to make someone act against their own interest. Phishing is the most widespread form of social engineering delivered by message. Other variants include business email compromise, invoice fraud, pretexting, and MFA fatigue attacks that spam approval prompts until a user accepts one.

Phishing is sent in bulk with a generic hook and hopes a small percentage respond. Spear phishing is targeted: the attacker researches the recipient, their role, colleagues, suppliers and current projects, then writes a specific and plausible message. Whaling targets senior executives, and business email compromise usually follows the compromise of a real mailbox so the message arrives from a genuine address.

Combine technical controls with human ones: multi-factor authentication on every account, email filtering and anti-spoofing records (SPF, DKIM and DMARC), managed endpoint protection, prompt patching, an easy way for staff to report suspicious messages, and regular Cyber Awareness Training with simulated phishing so people practise spotting real attacks. Cyber Essentials certification provides a structured baseline for the technical side.

Short, frequent training combined with realistic phishing simulation typically produces a measurable fall in click rates and, just as importantly, a rise in reporting rates over the first few months. Reporting matters because it gives your provider time to contain an attack. One-off annual training tends to fade quickly, which is why programmes are usually delivered monthly.

The guide walks through 12 practical warning signs that help employees and business owners spot phishing emails, suspicious links, fake websites, malicious attachments and social-engineering tactics before they become an incident. Each check includes a short explanation of why it matters and a quick defence you can apply immediately.

It is written for business owners, office managers, finance teams and any employee who uses email or the web at work. The language is plain English, not technical jargon, so it works equally well as a staff handout, an onboarding resource or a personal refresher.

Yes, it is completely free. You do not need to enter any payment information or subscribe to anything — complete the short form and the PDF unlocks immediately so you can save it, print it or share it with your team.

No. The checklist is a quick-reference tool that reinforces good habits. For lasting behaviour change — especially around phishing, social engineering and incident reporting — most SMEs benefit from structured Cyber Awareness Training that includes simulated phishing, short monthly modules and measurable reporting for managers.

Do not click links, open attachments or reply. Report it to your IT contact or security provider using the channel your business has agreed — usually a report button in Outlook or Google Workspace, or a direct message to your managed service provider. If you have already clicked or entered credentials, disconnect from the network and seek help immediately.