In fact, the National Cyber Security Centre states that 85% of cyber attacks against businesses start with a scam email and according to the UK Government’s Cyber Breaches Survey 25/26, 88% of businesses who had identified a cyber breach or attack had experienced phishing. This highlights just how widespread it has become.
Understanding what phishing emails are and knowing the warning signs can help protect your business from a potentially devastating cyber attack.
A phishing email is a fraudulent email that appears to come from a genuine source. That could be a customer, supplier or partner. Cybercriminals often impersonate well-known companies, banks, suppliers or even colleagues to increase the chances that the recipient may follow the actions required.
For example, an employee might receive and email from Microsoft, asking them to verify their account details to prevent their access from being suspended. The email could then contain a link to a fake login page which is designed to steal their username and password. Once cybercriminals obtain this information, they may be able to access critical business systems, steal confidential data or launch further cyber-attacks.
Although phishing emails have become more convincing, there are several common themes and warning signs that employees should look out for.
An unusual sender email address
A phishing email might display the name of a familiar company, but the actual email address could tell a different story. Look carefully for misspellings, additional characters or domains that don’t look right.
Sense of urgency
Phishing emails often include an action that needs to be taken immediately. They try and create pressure and when people are busy with their day to day work, they can be caught off guard and can hastily input details. Messages can include a suspension of an account, an overdue payment or urgent action required.
Suspicious links
A phishing email might encourage an employee to click a link to update details or to confirm a payment. Hovering over a link before clicking to check its destination helps to identify whether it’s suspicious or not. On a mobile device, don’t open links you can’t identify.
Unexpected attachments
Phishing emails with an attachment can often contain malicious software that’s designed to compromise your device or business network. Be cautious of unexpected invoices, delivery notifications or documents, even when they’re coming from a known source.
If unsure, it’s always best to contact the sender through a trusted communication channel before opening the attachment.
Requests for sensitive information
Legitimate organisations won’t ask for login details, payment or passwords over an email. Always be suspicious of messages requesting account credentials, financial information or changes to payment details.
Unusual language or formatting
Poor spelling, grammatical errors and inconsistent branding can indicate a phishing attempt. However, cybercriminals are increasingly using AI to create professional looking emails. A message with perfect spelling and convincing branding isn’t necessarily genuine.
If you think you have received a phishing attempt, then report the email to your IT team or designated IT contact, so they can investigate. If you have already clicked on a suspicious link then reporting it immediately helps to reduce the potential impact.
Technology plays an important role in protecting businesses against cyber threats, but employees are a vital part of the defence. Regular cyber security awareness training helps the team detect scam emails, understand the potential risks and feel more confident reporting concerns.
Sign up to FREE phishing simulations and help your team spot scam emails.
Your employees receive carefully designed simulated phishing emails that reflect common real-world threats.
The results can help you understand how your team responds and identify areas where additional guidance or cyber security awareness training could be beneficial.
