How do I spot a phishing email?

A phishing email is a fake message designed to trick you into clicking a link, opening an attachment, entering your password or sending money. They can look very convincing, but most give themselves away if you know what to look for.

The warning signs

• It's urgent or threatening. "Your account will be closed today", "Pay now to avoid a fine". Scammers want you to act before you think.
• The sender doesn't add up. The name looks right, but the email address doesn't, for example microsoft-support@outlook-security.co. Hover over or tap the sender's name to see the real address.
• Links go somewhere unexpected. Hover over a link before clicking. If the address it shows doesn't match who the email claims to be from, don't click it.
• It asks you to sign in. Be wary of any email that takes you to a page asking for your password, especially "your password has expired" or "you've been sent a document".
• It asks for money or gift cards. A request to pay a new invoice, change bank details or buy gift cards, even if it seems to come from your boss or a supplier.
• You weren't expecting it. An invoice you don't recognise, a parcel you didn't order, or a shared file from someone you don't normally work with.
• Something feels off. Odd greetings like "Dear user", strange wording, or an unusual tone from someone you know.

Common examples

• "Your Microsoft 365 password expires today. Click here to keep it."
• "You've received a secure document. Sign in to view it."
• "Please see the attached overdue invoice."
• "Our bank details have changed. Please update them for the next payment."
• "Are you free? I need a quick favour." (from someone pretending to be your manager)
• "We couldn't deliver your parcel. Pay a small fee to rebook."

Not sure? Check it

If an email looks like it's from someone you know but something feels wrong, contact them a different way, such as a phone number you already have. Don't reply to the email or use contact details from it.

Any request to change bank details or make an urgent payment should always be checked by phone before you act on it.

Think you've spotted one?

• Don't click any links, open attachments or reply.
• Report it to us. See How do I report a suspicious email?

Already clicked a link or entered your password? Don't worry, but act quickly. Call us on +44 20 4570 7149 straight away so we can secure your account.