Phishing remains one of the simplest ways for criminals to get into a business. The technology has improved, but so have the scams. A convincing email can copy a supplier, Microsoft 365 notification, bank, delivery company or even a senior member of staff.
For a small business, one successful phishing message can lead to a compromised mailbox, stolen data, fraudulent payments or ransomware. During Cyber Awareness Month, it is worth making sure everyone knows the warning signs before they click.
1. The message creates urgency
Phishing emails often try to stop people thinking. Typical examples include an account that will be suspended today, an invoice that must be paid immediately, a password that has supposedly expired, or a director asking for an urgent transfer.
Urgency is not proof that an email is malicious, but it should be a reason to slow down. If a message pressures you to act immediately, verify it using a separate method before doing anything.
2. The sender address is not quite right
A display name can say almost anything. An email may appear to come from Microsoft, your bank or a known supplier while the actual address belongs to an unrelated domain.
Look beyond the display name. Criminals also register domains that resemble genuine ones by changing, adding or removing a character. On a phone this can be particularly easy to miss because the full address may not be visible automatically.
3. The link does not go where you expect
A button saying “View document” or “Sign in to Microsoft 365” does not guarantee that the destination is genuine. On a computer, hovering over a link usually reveals where it really goes. On mobile devices, take extra care before opening it.
If an email says there is a problem with Microsoft 365, banking or another important service, it is often safer to open your normal browser bookmark or type the known website address yourself rather than following the email link.
4. You are unexpectedly asked to sign in
Fake Microsoft 365 login pages are common because a stolen business mailbox is valuable. Once criminals obtain credentials, they may read conversations, create forwarding rules, impersonate staff and wait for an opportunity to redirect a payment.
Multi-factor authentication helps, but it is not a reason to enter credentials into an unfamiliar page. Be suspicious of unexpected login prompts, particularly after clicking a link in an email or scanning a QR code.
5. The request changes the normal process
Many successful attacks exploit business processes rather than technical vulnerabilities. A supplier suddenly provides new bank details. A manager asks for gift cards. Someone wants a confidential document sent to a personal email address. A payment needs to bypass the normal approval process.
Changes like these should be independently verified. For payment or bank-detail changes, call the supplier using a telephone number you already hold, not one provided in the suspicious message.
6. The attachment is unexpected
Invoices, delivery notes, CVs and shared documents are all useful disguises for malicious attachments. Even familiar file types can be used to lead someone towards malware or a fake login page.
If you were not expecting the attachment, confirm it with the sender before opening it. Businesses should also keep Windows, browsers, Microsoft 365 applications and security software patched so that an accidental click is less likely to become a full compromise.
7. Something simply feels unusual
Modern phishing emails are not always full of spelling mistakes. Generative AI has made it easier to produce professional-looking messages with good grammar and convincing wording.
Context is increasingly important. Is this how the person normally writes? Would they normally make this request? Is the invoice expected? Does the message arrive at an unusual time? Staff should feel comfortable questioning something that does not fit the normal pattern.
What should staff do with a suspicious email?
The safest response is simple: do not click, do not reply and do not open the attachment. Report the message using your organisation’s normal process or send it to whoever manages your IT security.
If someone has already clicked a link or entered their password, reporting it quickly matters. Do not wait to see whether anything happens. Password resets, session revocation, mailbox checks and other containment measures are much more effective when carried out early.
Cyber awareness works best when reporting is easy
Security awareness should not be about catching staff out. People need a straightforward way to ask, “Does this look right?” without worrying that they will be criticised for raising a false alarm.
ML Services helps businesses across Sussex protect Microsoft 365, email, endpoints and business data, as well as providing ongoing IT support when something suspicious does arrive. If you would like help reviewing your email security or staff reporting process, contact ML Services.