Phishing Attacks 101: How to Spot and Stop Them

You receive an email from “Royal Mail” saying there’s a problem with a delivery and you need to update your payment details. Or perhaps it’s from “Microsoft” warning that your account has been compromised and you must reset your password immediately. Maybe it’s an urgent message from your “CEO” asking you to process a payment right away.

These are all examples of phishing attacks — and they’re the single most common way cybercriminals gain access to business systems, steal credentials, and compromise sensitive data.

According to the UK Government’s Cyber Security Breaches Survey, 83% of cyber attacks on businesses are phishing attempts. They’re effective because they exploit human psychology rather than technical vulnerabilities. Even technically sophisticated organisations fall victim when staff are caught off-guard by a convincing message.

The good news? With awareness and vigilance, phishing attacks are largely preventable. This guide will help you and your team recognise phishing attempts, understand why they’re dangerous, and implement practical defences.

What Is Phishing?

Phishing is a type of social engineering attack where criminals impersonate legitimate organisations or individuals to trick you into:

• Revealing passwords or other credentials
• Clicking malicious links that install malware
• Downloading infected attachments
• Transferring money or sensitive information
• Providing access to systems or data

The name comes from “fishing” — attackers cast out bait (convincing-looking messages) hoping someone will bite.

Common Types of Phishing

Email phishing — Mass emails sent to thousands of people pretending to be from banks, delivery companies, government bodies, or well-known services. These are the most common type.

Spear phishing — Targeted attacks aimed at specific individuals or organisations. These use personalised information to seem more credible.

Whaling — Phishing attacks specifically targeting senior executives or high-value individuals. Often involve fake legal notices, customer complaints, or other business matters.

Smishing (SMS phishing) — Phishing via text message, often claiming to be from delivery services, banks, or government agencies.

Vishing (voice phishing) — Phone calls from attackers pretending to be from technical support, banks, HMRC, or other official bodies.

Business Email Compromise (BEC) — Sophisticated attacks where criminals impersonate executives or suppliers to request payments or data.

Why Phishing Is So Dangerous

Phishing attacks are the gateway to more serious cyber incidents. Once attackers obtain credentials or install malware, they can:

Steal Sensitive Data

Access to email accounts provides a treasure trove of information: client details, financial records, contracts, strategic plans, and more. This data can be sold, used for identity theft, or leveraged for further attacks.

Gain System Access

Compromised credentials let attackers access your business systems, cloud services, databases, and networks. From there, they can move laterally through your infrastructure, accessing increasingly sensitive areas.

Deploy Ransomware

Many ransomware attacks begin with phishing emails. Once attackers are inside your network, they deploy ransomware that encrypts your files and demands payment for the decryption key.

Commit Financial Fraud

Business Email Compromise attacks have led to fraudulent transfers of hundreds of thousands of pounds. Attackers impersonate executives or suppliers, requesting urgent payments to “new” bank accounts.

Damage Reputation

Data breaches resulting from phishing attacks damage client trust and can lead to loss of business. The reputational impact often exceeds the direct financial cost.

Violate Regulations

If phishing attacks lead to personal data breaches, you may face GDPR violations, regulatory investigations, and potential fines.

“Phishing attacks succeed not because of sophisticated technology, but because they exploit human nature — urgency, trust, fear, and curiosity. Awareness is your best defence.”

Common Red Flags in Phishing Attempts

Learning to spot phishing emails is a crucial skill for everyone in your organisation. Here are the telltale signs:

1. Urgent or Threatening Language

Phishing emails create artificial urgency to pressure you into acting without thinking:

• “Your account will be suspended within 24 hours”
• “Urgent action required”
• “Immediate payment needed”
• “Security alert: verify your identity now”
• “Final notice”

Reality check: Legitimate organisations rarely threaten immediate account closure and typically provide multiple contact options rather than forcing action through a single link.

2. Suspicious Sender Addresses

The sender’s email address often reveals phishing attempts:

Look carefully at:

• Addresses that look similar but aren’t quite right: support@amaz0n.com instead of amazon.com
• Generic domains: service@gmail.com instead of the company’s actual domain
• Strange characters or numbers: paypal-security2024@outlook.com
• Completely unrelated domains: supposedly from HMRC but sent from a .ru domain

How to check: Hover over the sender’s name (don’t click) to see the actual email address. Be especially wary of emails from external domains claiming to be from colleagues.

3. Generic Greetings

Phishing emails often use impersonal greetings because they’re mass-sent:

• “Dear customer”
• “Dear user”
• “Hello sir/madam”
• “Valued client”

What to expect: Legitimate organisations typically use your name, especially if you have an account with them.

4. Poor Grammar and Spelling

Many phishing emails contain obvious errors:

• Misspellings and typos
• Awkward phrasing
• Inconsistent formatting
• Mix of fonts or styles

Why it happens: Many phishing emails originate from non-English-speaking countries or are run through automated translation.

Note: Increasingly sophisticated attacks have better grammar, so don’t rely solely on this indicator.

5. Suspicious Links

Hover over links (without clicking) to see where they actually lead:

Warning signs:

• URL doesn’t match the supposed sender (email from “Barclays” with a link to a random domain)
• Shortened URLs (bit.ly, tinyurl) that hide the real destination
• Misspelled domains: paypa1.com, micros0ft.com
• IP addresses instead of domain names
• Suspicious domains: secure-login-verify.com, account-validation.net

Safe practice: Rather than clicking email links, navigate directly to the website by typing the address yourself or using a bookmark.

6. Unexpected Attachments

Be wary of attachments you weren’t expecting, especially:

• .exe, .zip, or .scr files
• Macros-enabled documents (.docm, .xlsm)
• Files with double extensions (invoice.pdf.exe)
• Attachments from unknown senders

Best practice: Verify unexpected attachments by contacting the sender through a different channel before opening.

7. Requests for Sensitive Information

Legitimate organisations never ask for sensitive information via email:

Red flags:

• Requests for passwords, PINs, or security codes
• Asking for banking details or card numbers
• Requests to confirm personal information
• Prompts to download “security certificates” or “verification tools”

Remember: Banks, HMRC, and legitimate services will never ask for credentials via email.

8. Too Good to Be True

Phishing emails often offer unrealistic opportunities:

• You’ve won a prize you didn’t enter
• Unclaimed inheritance from an unknown relative
• Get-rich-quick schemes
• Unbelievable discounts (90% off luxury goods)
• Job offers requiring upfront payment

Reality check: If it seems too good to be true, it almost certainly is.

9. Mismatched Branding

Phishing emails often have subtle branding inconsistencies:

• Outdated logos
• Wrong colours or fonts
• Poor-quality images
• Generic formatting unlike the company’s usual style

Compare: If you’ve received legitimate emails from the organisation before, compare the styling and formatting.

Real-World Phishing Examples

Understanding actual phishing tactics helps you recognise them:

Example 1: Fake Delivery Notification

The email: “Royal Mail attempted delivery. Your parcel is being held. Click here to reschedule and pay £2.99 storage fee.”

Red flags:

• Creates urgency (parcel being held)
• Small payment amount seems reasonable
• Link goes to royal-mai1.com (notice the “1” instead of “l”)
• Royal Mail doesn’t charge storage fees for missed deliveries

The danger: Clicking leads to a fake payment page stealing card details, or downloads malware.

Example 2: Office 365 Credential Harvest

The email: “You have 3 unread voicemail messages. Your Office 365 mailbox is full. Click here to review messages.”

Red flags:

• Sender address: no-reply@mail-notification.com (not Microsoft)
• Creates urgency (full mailbox)
• Link goes to convincing-looking but fake Microsoft login page
• Legitimate voicemail notifications come through your phone system, not email

The danger: Entering credentials on the fake page gives attackers full access to your email account.

Example 3: CEO Fraud (Business Email Compromise)

The email: Seemingly from your CEO: “I’m in a meeting with a potential client. Need you to process an urgent payment. I’ll send bank details in the next email. Keep this confidential.”

Red flags:

• Unusual urgency and confidentiality request
• Request to keep quiet (preventing verification)
• Sender address may be spoofed or from a compromised account
• Payment to an unfamiliar account

The danger: Staff transfer thousands of pounds to attacker-controlled accounts before realising the fraud.

Example 4: HMRC Tax Refund Scam

The email: “You are due a tax refund of £487.32. Click here to claim your rebate.”

Red flags:

• HMRC contacts you by post for tax refunds, not email
• Link goes to fake HMRC website
• Requests personal information and bank details

The danger: Victims provide personal information used for identity theft and bank details for fraudulent withdrawals.

Example 5: IT Support Scam

The email: “Your Microsoft subscription has expired. Your account will be deleted in 24 hours. Click here to renew immediately.”

Red flags:

• Creates panic with immediate deadline
• Sender not from Microsoft domain
• Link to fake renewal page
• Microsoft wouldn’t delete accounts without extensive warnings

The danger: Fake payment page steals card information, or download installs remote access software.

The Anatomy of a Credential-Stealing Site

When phishing emails succeed in getting users to click links, they typically lead to fake login pages designed to steal credentials.

What These Sites Look Like

Convincing copies: Attackers create near-perfect replicas of legitimate login pages for:

• Microsoft 365
• Google Workspace
• Banking websites
• PayPal
• Dropbox
• LinkedIn
• Any popular service

Subtle differences:

• URL is wrong (even if the page looks perfect)
• May use HTTPS and have padlock icon (doesn’t guarantee legitimacy)
• Often missing privacy policies, terms of service, or other footer links
• Forms may have slightly different field labels
• “Remember me” and “Forgot password” links might not work properly

How to Protect Yourself

Always check the URL — Before entering credentials anywhere, verify you’re on the legitimate website. Look at the domain carefully.

Use bookmarks — Save legitimate login pages as bookmarks and always use these rather than clicking email links.

Enable MFA — Even if attackers steal your password, multi-factor authentication prevents them accessing your account.

Use a password manager — Password managers only auto-fill credentials on genuine sites, providing an automatic phishing detector.

Consequences of Falling for Phishing

Understanding what happens when phishing succeeds helps motivate prevention:

Immediate Impact

Compromised accounts — Attackers gain access to email, cloud services, business systems, and any other accounts using the stolen credentials.

Data theft — Customer information, financial records, intellectual property, and sensitive business data may be stolen.

Malware infection — Clicking links or downloading attachments can install ransomware, keyloggers, or remote access trojans.

Financial loss — Direct theft through fraudulent transfers, or costs of incident response and recovery.

Longer-Term Consequences

Regulatory violations — Personal data breaches must be reported to the ICO within 72 hours. Serious breaches can result in fines up to £17.5 million or 4% of annual turnover under GDPR.

Reputation damage — Customers and partners lose trust when data breaches become public. This can impact sales and business relationships long-term.

Operational disruption — Recovering from security incidents takes time and resources. Ransomware attacks can shut down operations for days or weeks.

Legal liability — Affected customers may pursue compensation claims. Suppliers or partners whose data was compromised through your systems may take legal action.

Increased costs — Insurance premiums rise after incidents. You may need enhanced security measures, monitoring, and credit monitoring services for affected customers.

A Real Scenario

A small accountancy firm’s office manager received an email seemingly from the managing partner requesting an urgent payment to a “new supplier”. The email looked legitimate, coming from what appeared to be the partner’s email address.

The office manager transferred £45,000 to the provided account. Only when the partner returned from a meeting and was asked about it did they discover the fraud. The email had come from a compromised account with a slightly different domain.

The money was never recovered. The firm faced:

• Direct financial loss of £45,000
• Three days of operational disruption while investigating
• ICO notification (client payment data was involved)
• Reputation damage when the breach became known
• Implementation of new security measures
• Increased insurance premiums
• Ongoing concern about other potential compromises

The cost: Over £65,000 total, not including the value of staff time and long-term reputation impact — all from a single phishing email.

How to Protect Your Business from Phishing

Protection requires multiple layers — technical controls, policies, and most importantly, awareness.

1. Implement Multi-Factor Authentication (MFA)

MFA is your strongest defence. Even if attackers steal passwords, they can’t access accounts without the second factor.

Enable MFA on:

• Email accounts
• Cloud services and SaaS platforms
• Banking and financial systems
• Administrative accounts
• VPN access
• Any system containing sensitive data

Choose strong MFA methods:

• Authenticator apps (Google Authenticator, Microsoft Authenticator, Authy)
• Hardware security keys (YubiKey)
• Avoid SMS-based MFA where possible (vulnerable to SIM-swapping)

2. Deploy Email Security Solutions

Modern email security goes beyond basic spam filtering:

Advanced threat protection — Scans links and attachments for malicious content, including analysis of URL destinations and file behaviour.

Impersonation detection — Identifies emails pretending to be from executives or trusted contacts.

Warning banners — Automatically adds warnings to emails from external sources or flagged as suspicious.

Link protection — Rewrites URLs to scan destination sites before allowing access.

Attachment sandboxing — Opens attachments in isolated environments to detect malicious behaviour before delivering to users.

Most email providers offer these features — Microsoft 365, Google Workspace, and standalone solutions from Mimecast, Proofpoint, and others.

3. Use Spam and Malware Filtering

While not foolproof, quality filtering catches a significant percentage of phishing attempts:

• Configure filtering policies appropriately for your risk level
• Regularly review quarantined items for false positives
• Keep filter definitions updated
• Consider both gateway filtering and endpoint protection

4. Implement Email Authentication

Technical measures that help prevent email spoofing:

SPF (Sender Policy Framework) — Defines which servers can send email on behalf of your domain.

DKIM (DomainKeys Identified Mail) — Adds digital signatures to verify emails haven’t been tampered with.

DMARC (Domain-based Message Authentication, Reporting & Conformance) — Builds on SPF and DKIM to provide clear policies for handling failed authentication.

Implementing these (or having your IT provider do so) makes it harder for attackers to impersonate your domain.

5. Establish Clear Verification Procedures

Create and enforce policies for sensitive actions:

Financial transfers:

• Require verbal confirmation for all payment requests received via email
• Use a known phone number, not one provided in the email
• Never process urgent payment requests without verification
• Implement dual-authorisation for transfers above certain thresholds

Information requests:

• Verify unusual requests for sensitive data through separate channels
• Be especially cautious with requests claiming confidentiality
• Question requests that bypass normal procedures

System changes:

• Verify requests for password resets or system access through established procedures
• Don’t process access requests based solely on email

6. Conduct Regular Awareness Training

Human awareness is your first line of defence:

Quarterly training sessions covering:

• Latest phishing tactics and real examples
• How to identify suspicious emails
• What to do when receiving suspected phishing
• Company policies and procedures
• Consequences of security incidents

Simulated phishing exercises:

• Send fake (safe) phishing emails to test awareness
• Provide immediate education when staff click or provide information
• Track improvements over time
• Celebrate success, don’t punish clicks (create a learning culture)

Create reporting culture:

• Make it easy to report suspicious emails
• Reward vigilance rather than punishing mistakes
• Share examples of reported phishing attempts (anonymously)
• Provide feedback on reported items

7. Keep Software Updated

Phishing emails often exploit software vulnerabilities:

• Enable automatic updates for operating systems
• Keep browsers and email clients current
• Update plugins and add-ons regularly
• Replace unsupported software

8. Use Reputable Security Software

Endpoint protection provides additional layers:

• Antimalware software on all devices
• Real-time scanning of downloads and websites
• Behaviour-based detection for zero-day threats
• Regular scanning schedules

9. Limit User Privileges

Reduce damage from successful phishing:

• Don’t give users administrative rights unless necessary
• Implement principle of least privilege (users only get access they need)
• Regularly audit and remove unnecessary access
• Use separate admin accounts for administrative tasks

10. Maintain Secure Backups

Backups protect against ransomware delivered via phishing:

• Follow 3-2-1 rule (3 copies, 2 media types, 1 offsite)
• Keep backups disconnected from network (prevents encryption)
• Test restoring from backups regularly
• Ensure backups include all critical data and systems

What to Do If You Click a Phishing Link

If you or a team member clicks a suspicious link or provides credentials, act quickly:

Immediate Actions

1. Disconnect from network — If you downloaded something suspicious, disconnect from WiFi/ethernet immediately to prevent malware spread.

2. Don’t panic — Quick, calm action minimises damage.

3. Report immediately — Notify your IT support or security team right away. Don’t hide mistakes — early reporting prevents greater damage.

4. Change passwords — If you entered credentials anywhere, change passwords immediately on all affected accounts and any using the same password.

5. Enable MFA — If not already enabled, activate multi-factor authentication on affected accounts immediately.

6. Scan for malware — Run a complete antimalware scan if you downloaded anything or visited suspicious sites.

7. Check account activity — Review recent logins, sent items, and account changes for suspicious activity.

8. Notify relevant parties — If the account accesses customer data or financial systems, notify appropriate people so they can monitor for misuse.

Follow-Up Actions

Monitor accounts — Keep close watch on affected accounts for several weeks for suspicious activity.

Review what happened — Understand how you were tricked to avoid similar attacks.

Update credentials — Consider this an opportunity to improve password practices across all accounts.

Learn from it — Share the experience (anonymously if preferred) to help colleagues learn.

How JB Cyber Services Can Help

Protecting against phishing requires ongoing vigilance, the right technical measures, and well-trained staff. We help UK businesses of all sizes implement effective phishing defences.

Security Awareness Training

We provide engaging, practical training tailored to your team:

Customised training sessions covering:

• Real-world phishing examples relevant to your industry
• Hands-on identification exercises
• Your specific policies and procedures
• Interactive Q&A and scenario discussion

Simulated phishing campaigns:

• Regular safe phishing tests for your team
• Immediate educational content when users click
• Progress tracking and reporting
• Customised scenarios based on current threats

Ongoing awareness:

• Quarterly refresher sessions
• Current threat briefings
• Practical security tips and reminders

Technical Implementation

We can implement and configure technical defences:

Email security solutions:

• Advanced threat protection configuration
• Spam and malware filtering optimisation
• Email authentication (SPF, DKIM, DMARC)
• Warning banner implementation

Multi-factor authentication:

• MFA deployment across your services
• User training and onboarding
• Policy configuration
• Recovery procedure establishment

Endpoint protection:

• Antimalware deployment and management
• Regular scanning and monitoring
• Threat detection and response

Policy and Procedure Development

We help establish clear security policies:

• Payment verification procedures
• Sensitive data handling policies
• Incident reporting procedures
• Access control policies
• Remote work security guidelines

Security Assessments

We conduct phishing vulnerability assessments:

• Email security configuration review
• User awareness baseline testing
• Policy and procedure evaluation
• Technical control effectiveness
• Recommendations for improvement

Incident Response Support

If phishing attacks succeed, we provide rapid response:

• Immediate containment and assessment
• Malware removal and system cleaning
• Credential reset assistance
• Investigation and root cause analysis
• Recovery planning and implementation

Ongoing Security Partnership

Regular phishing defence requires continuous effort:

• Quarterly training and simulated phishing
• Monthly security briefings on current threats
• Regular technical review and optimisation
• 24/7 incident response support
• Continuous monitoring and improvement

Creating a Security-Aware Culture

Technology alone won’t stop phishing — you need a culture where security is everyone’s responsibility:

Encourage reporting — Staff should feel comfortable reporting suspicious emails without fear of blame. Every report is an opportunity to learn and improve.

Celebrate vigilance — Recognise and thank staff who report phishing attempts. Share examples (with permission) to educate others.

Learn from incidents — When someone falls for phishing, use it as a learning opportunity for the entire team, not punishment for the individual.

Lead from the top — Executives and managers should model good security behaviour, follow policies, and participate in training.

Make security easy — The easier you make secure practices (password managers, MFA, reporting), the more likely staff will follow them.

Regular reinforcement — Security awareness isn’t a one-time training session. Regular reminders, updates on current threats, and ongoing education are essential.

Integrate into onboarding — New staff should receive security training as part of their induction.

Conclusion

Phishing attacks remain the most common and often most effective way criminals compromise businesses. They succeed not through technical sophistication but by exploiting human psychology — urgency, trust, fear, and occasional inattention.

The good news is that with awareness, vigilance, and appropriate technical defences, phishing attacks are largely preventable. No single measure provides complete protection, but a layered approach combining technology, policies, and well-trained staff creates effective defence.

Key takeaways:

• Stay vigilant — Always pause before clicking links or providing information via email
• Verify unexpected requests — Especially those involving money, data, or credentials
• Enable MFA everywhere — Your strongest single defence against credential theft
• Report suspicious emails — Even if unsure, report anything that seems odd
• Keep learning — Phishing tactics evolve constantly, so ongoing awareness is essential

Remember: it’s not paranoia to question emails — it’s prudence. Legitimate organisations understand security concerns and won’t mind verification. A few minutes spent verifying a suspicious email could save your business from a devastating security incident.

If you’d like help improving your organisation’s phishing defences, implementing security awareness training, or responding to a suspected compromise, we’re here to help. Protecting UK businesses from cyber threats is what we do.

Stay alert, stay secure, and when in doubt, verify before you click.