Phishing Emails: What to Look For (and What to Do)

Phishing is not a new threat. But it is getting smarter, faster, and harder to spot.

In 2025, phishing was still the most common way cyber criminals gained access to business systems. Not through clever hacking. Through an email that looked legitimate.

The best phishing emails do not look like phishing emails. That is the entire point.

What Is Phishing?

Phishing is when an attacker sends a fake email (or text, or message) designed to trick you into doing something. That something is usually:

• Clicking a malicious link
• Entering login credentials on a fake website
• Downloading a harmful attachment
• Sending money or sensitive information

It works because it exploits trust, urgency, and habit.

Red Flags to Watch For

Not every phishing email is obvious, but most share common patterns:

• Urgency: "Your account will be suspended in 24 hours"
• Generic greetings: "Dear Customer" instead of your name
• Suspicious sender: The email address does not quite match the real one
• Spelling and grammar: Professional companies rarely send emails with errors
• Unexpected attachments: Especially ZIP, EXE, or macro-enabled documents
• Too good to be true: Prize notifications, unexpected refunds, free offers

The single best habit? Pause before you click.

What to Do If You Think You Have Been Phished

If you have clicked a suspicious link or entered credentials somewhere you should not have:

• Change your password immediately
• Enable multi-factor authentication if you have not already
• Report it to your IT support provider
• Do not forward the email to colleagues
• Check for unusual activity on your accounts

Speed matters. The sooner you act, the less damage can be done.

Why Staff Training Is Your Best Defence

Technology can block many phishing emails, but not all of them. The last line of defence is always a human being making a decision.

Cyber security awareness training is not about making people feel stupid. It is about giving them the tools to make better decisions under pressure. For teams handling personal data, this should sit alongside data protection training for staff so people understand both security risk and compliance obligations.

Businesses that train their staff regularly see significantly fewer successful phishing attacks.

Technical Controls That Help

Good cyber security combines awareness with technology:

• Email filtering and spam protection
• Multi-factor authentication on all business accounts
• Web filtering to block known malicious sites
• Endpoint protection on every device
• Regular security updates and patching

If you are not sure whether your business has these in place, take our free health check to find out.

Final Thought

Phishing works because it targets people, not systems.

The best protection is a team that knows what to look for and feels confident enough to question anything that does not feel right.

If something feels off, it probably is. Trust your instincts. And if you handle personal data, make sure your GDPR compliance is up to scratch, a breach caused by phishing has regulatory consequences too. Our guides on data protection awareness training and breach reporting for staff are a good next step.