Forget everything you were told about looking for spelling mistakes. Modern phishing emails are well written, correctly branded, and increasingly personalised using information scraped from your own website and LinkedIn.
The five signs that still work
1. Urgency
“Needs paying today.” “Your account will be suspended in 24 hours.” Urgency exists to stop you thinking. If an email is rushing you, that is the signal.
2. An unexpected change to payment details
A supplier emails to say their bank details have changed. This is the single most expensive phishing attack in the UK, and it is almost always fraudulent. Verify it by phoning the supplier on a number you already had — never a number in the email.
3. The reply-to does not match the display name
The name says “Sarah Jones, Finance”. Click into the actual address and it is a Gmail account, or a domain with one letter changed. On a phone, the display name is often all you see, which is exactly why phishing works so well on mobiles.
4. A link that does not go where it says
Hover before you click. On a phone, press and hold to preview. Look at the domain immediately before the first single slash — that is the real destination, however much legitimate-looking text comes after it.
5. It asks you to log in to see something
A document you were not expecting, a “secure message”, a shared file that wants your Microsoft password. Go to the service directly in your browser rather than through the link.
What to do if someone has clicked
Speed matters more than blame. In order:
- Change the password for the affected account immediately
- Sign out of all sessions and check for any mail forwarding rules the attacker has added — this is the classic move, and it is easily missed
- Check whether multi-factor authentication was bypassed or a new device enrolled
- Tell your IT support. Today, not on Monday
Above all, make sure your team know they will not be told off for reporting a click. The organisations that get badly hurt are the ones where someone clicked at 4pm and said nothing until Thursday.
The unglamorous defences that actually work
Multi-factor authentication everywhere. Staff who have been trained rather than merely emailed a policy. Sensible email filtering. Patched machines. None of it is exciting, and all of it is why Cyber Essentials exists in the shape it does.
We will audit your setup for free and tell you where the gaps are — see cyber security or book a free security audit.
Find your gaps before an attacker does
A free security audit from a local team. We will look at your email security, your multi-factor setup and your patching, and tell you plainly where you stand.
Or call us on 01761 347198. We are a local team — you will speak to a person, not a queue.