Spotting Phishing Emails Before They Cause Harm

Why small teams get the most attention

Phishing emails are not written for you personally. They are written for a list, and that list includes sole traders, two-person agencies, bookkeepers and anyone who answers their own phone. Big firms have an IT department to filter the rubbish. You have a Tuesday afternoon between client calls. That is exactly why a handful of simple checks, done consistently, will protect you better than any expensive tool.

The good news is that most phishing emails give themselves away before you click anything. You just need to know where to look.

Start with the sender address, not the display name

The name shown in your inbox is easy to fake. Anyone can set it to "HMRC", "Accounts Payable" or the name of your biggest client. The part after the @ symbol is the bit that matters, so read it properly rather than glancing at it.

• Look for lookalike domains: a lowercase r and n pushed together to look like an m, extra hyphens, or a .co where the real domain uses .co.uk.
• Check whether the reply-to address differs from the sender. Some email apps show this when you open the message. A mismatch is a red flag.
• Be suspicious when a business matter arrives from a free webmail account, or when a supplier you have used for years suddenly emails from a new domain.
• Watch for legitimate domains with extra words bolted on, such as the company name followed by something like ".secure-mail" before the final ending.

None of these on their own proves fraud. Two or three together means you should stop and verify before doing anything.

Hover over every link before you click

On a desktop, rest your cursor over the link without clicking. Most email clients show the true destination in a strip at the bottom of the window. On a phone, press and hold the link to see a preview of the address.

• Does the visible text match where you are actually being sent? A link saying your bank's name that points somewhere unrelated is a clear no.
• Read the address from the right, not the left. The real domain sits immediately before the first single slash. Something ending in a long string of words with your bank's name buried in the middle is not your bank.
• Treat buttons inside image banners and shortened links with extra care, as you cannot see where they lead at all.
• If you want to log in to a service, close the email and type the address yourself, or use a bookmark you saved earlier. That single habit defeats most credential-stealing emails.

Verify unusual requests on a number you already have

This is the check that saves the most money. Fraudsters are very good at sounding like a client, a director or a supplier, and they often know real details such as invoice numbers and project names, because those get copied from earlier genuine emails.

Treat any of the following as a trigger to pick up the phone:

• A change of bank details, on a new invoice or as a "quick update" to an old one.
• A request to make an urgent payment, especially one that must happen today.
• Instructions to buy gift cards, vouchers or cryptocurrency.
• A message asking you to keep something quiet from colleagues, or explaining that the sender cannot talk because they are in meetings all day.

The rule is simple and absolute: never use contact details supplied in the email itself. Find the number on a previous invoice, in your contract, on your own records or on the company's website typed in manually. Then ring and confirm. If the person cannot be reached, wait. A payment delayed by an hour costs you nothing. A payment sent to a fraudster's account is very rarely recovered.

Read the tone, and notice what feels slightly off

Phishing relies on pressure. That pressure usually shows up in the language.

• Urgency: "your account will be closed today", "final reminder", "immediate action required".
• Threats: penalties, legal action, a suspended service or a missed delivery.
• Generic greetings such as "Dear Customer" when the sender normally uses your first name.
• Unexpected attachments, particularly invoices, remittance advices, shipping labels or password-protected files.
• A sudden move to text or messaging apps, away from the email thread where things are harder to fake.

Also trust the small factual details. A company number that does not match, a bank name you have never used, an invoice number that sits outside your usual sequence, or a strange signature line. If something feels odd, slow down and check. Your instinct is usually right, and it costs nothing to be careful.

Make it a two-minute habit

You do not need a formal security policy. You need one rule and a bit of practice: never log in or pay out because of an email you were not expecting.

When something suspicious arrives, do not just delete it. Report it to your email provider where that option exists, warn anyone else in the team, and tell the client or supplier whose name was used, since they will want to know their account has been impersonated. Share near misses rather than hiding them. A colleague who admits they nearly paid a fake invoice teaches everyone more than a warning poster ever will.

Finally, back up the basics. Turn on two-factor authentication wherever it is offered, keep your devices and email app updated, and use a password manager so that one stolen password does not unlock everything else. Phishing works best when people are rushed and tired. A few seconds of checking, every single time, is the whole defence.