How to spot a phishing email and what to do next

1. Check the full sender address

Email apps often show the sender’s name more prominently than their address. Expand the sender details and look at the part after the @.

A familiar address can also appear on a fraudulent message, including when someone has gained access to a genuine mailbox. If the request is unusual, verify it even when the sender address looks right.

Microsoft’s guide to suspicious messages in Outlook

2. Pay attention to what the message asks you to do

A convincing logo and a well-written email are easy to reproduce. The request itself often tells you more.

• “We’ve changed our bank details.” Check with your supplier using a number already on file before updating any payment records.
• “Your mailbox will be suspended today.” Open Outlook or your usual Microsoft 365 portal directly and check whether there’s a genuine issue.
• “Scan this QR code to view the document.” A QR code can take you to the same fake sign-in page as a link. Confirm who shared the document first.
• “Approve the sign-in so I can finish setting up your account.” If you didn’t start the sign-in, deny the request and tell IT.
• “I’m in a meeting. Keep this between us.” An instruction to bypass normal checks is a reason to pause, especially if it involves money or sensitive information.

Attackers can use genuine email threads to make a request feel routine. An invoice you were expecting can still contain an unexpected change to the payment instructions.

NCSC guidance for small organisations

3. Verify the request through a route you already trust

For a colleague, start a new Teams chat or call their saved number. For a supplier, use the contact details in your supplier records. For an account alert, open the app or use your usual bookmark and check there.

If you’re on a computer, hovering over a link can reveal where it goes. A mismatch is a reason to stop. On a phone, or whenever the address is hard to read, go straight to the service through your usual app or bookmark. Avoid relying on the phone number, reply address or link supplied in the message you’re checking.

Microsoft’s guide to protecting yourself from phishing

4. Report it, even if you’re unsure

At work, use your organisation’s reporting process. If your version of Outlook offers it, select the message and choose Report → Report phishing. Include a short note to IT if the message relates to a live invoice, a supplier or an account other people might be using. One report can help IT check whether colleagues received the same message.

In the UK, you can also forward suspicious emails to [email protected]. For work messages that contain sensitive information, follow your organisation’s reporting process first.

NCSC guidance on reporting scam emails

What if you’ve already clicked?

Tell IT promptly if it happened on a work device or account. Give them the approximate time, the device you used and exactly what you did. Those details help them decide how to respond.

• You opened the link only. Close the page. Tell IT whether anything downloaded or whether you granted any permissions.
• You entered a password, shared a code or approved a sign-in. Contact IT immediately through a trusted route. Use a trusted device and the official sign-in page to change the exposed password, following IT’s guidance. Change it anywhere else you reused it.
• You opened a suspicious attachment or installed software. Stop using the device for work and contact IT from another device. Let them assess whether it needs to be isolated.
• You shared card details or sent money. Call your bank immediately using its official number and alert your finance team. Keep the message and any payment reference for the investigation.

For a suspected Microsoft 365 account takeover, IT may also need to revoke active sessions and check sign-in activity, registered authentication methods and mailbox forwarding rules.

NCSC phishing response guidance · Microsoft’s compromised mailbox guidance