This is not a guide for people who fall for obvious scams. It is a guide for everyone who sends and receives email in a professional context and wants to be certain they can identify every phishing attempt — including the sophisticated ones that bypass spam filters, mimic real brands precisely, and come from addresses you would normally trust.
According to the UK Government's Cyber Security Breaches Survey 2025, phishing remains the most prevalent and disruptive attack type — experienced by 85% of UK businesses that suffered a cyber breach, and responsible for 93% of all cybercrime against UK organisations. For small businesses specifically, the financial and reputational consequences of one successful phishing attack can be devastating. This guide gives you the knowledge to stop that from happening.
The 12 red flags this guide covers:
- 🚩 The sender address trick that fools even experienced email users
- 🚩 Urgency language — the psychological mechanism behind every phishing attack
- 🚩 How to check a link before you click it (and why hovering is no longer enough)
- 🚩 Attachment types that deliver malware — including the ones that look safe
- 🚩 Generic and personalised greeting tells — and why neither is definitive
- 🚩 The one request a legitimate organisation will never make by email
- 🚩 Branding inconsistencies that reveal impostor emails on closer inspection
- 🚩 Process bypass requests — the hallmark of CEO fraud and invoice scams
- 🚩 Refunds, tax rebates, and prize notifications — offer-based phishing patterns
- 🚩 QR code phishing (quishing) — the technique that bypasses email filters entirely
- 🚩 Emails from compromised accounts — when your trusted contacts become the threat
- 🚩 AI-generated phishing — why perfect grammar is no longer reassuring
What Phishing Actually Looks Like in 2026
Phishing is the use of fraudulent communication — overwhelmingly email — to trick someone into taking an action that benefits an attacker. That action usually involves one of three things: clicking a link that leads to a fake login page designed to steal your credentials, opening an attachment that installs malware on your device, or transferring money or changing payment details based on false instructions.
What makes phishing in 2026 categorically different from five years ago is the combination of two factors. First, AI tools allow attackers to generate highly personalised, grammatically flawless, contextually accurate phishing emails at scale — removing the obvious tells that made earlier phishing easier to identify. Second, over 57% of phishing emails now originate from compromised legitimate accounts — meaning the email genuinely comes from a known person or organisation's actual email address, just one that an attacker has quietly taken control of.
⚠️ The old rules no longer apply
In 2026, you cannot rely on poor grammar to identify phishing. You cannot rely on an unfamiliar sender address — compromised accounts send phishing from addresses you recognise and trust. You cannot rely on visual design being obviously wrong — AI-generated phishing uses pixel-perfect branding clones. Spotting phishing now requires checking technical signals, not just reading the content.
The types of phishing targeting UK businesses most frequently in 2026 include standard email phishing (bulk attempts), spear phishing (targeted, researched attacks on specific individuals), CEO fraud and Business Email Compromise (BEC), invoice redirect fraud, and QR code phishing (quishing) that bypasses email security filters entirely. Each has distinct patterns — and each is covered in this guide.
🚩 Red Flag 1 — The Sender's Email Address Is Wrong
Check the actual email address — not just the display name
Risk Level: Very High — Most commonly exploited red flag
Your email client shows two things when an email arrives: a display name (what the sender called themselves) and the actual email address. Most people read the display name and stop there. Attackers know this — and exploit it as the foundation of almost every phishing campaign.
A display name of "HMRC Tax Refunds" or "Microsoft Support" or "Sarah from Accounts" tells you nothing about the actual sender. The real address — visible by clicking or hovering on the display name — is where the truth lives.
HMRC has calculated that you are owed a tax refund of £847.20 for the 2024–25 tax year. To receive your refund, please verify your bank details within 48 hours by clicking the link below.
→ Claim your refund at: hmrc-taxrefund-secure.co.uk/claim
What's wrong: The display name says "HMRC Tax Office" but the actual address is @hmrc-taxgov.co.uk — not the real @hmrc.gov.uk. The link domain is also fake. HMRC never contacts taxpayers this way. Two red flags in one email.
In 2026, attackers also exploit look-alike domains — registering addresses like support@micros0ft.com (zero instead of o), paypal@paypal-secure.com (extra subdomain), or invoices@companynamе.co.uk (Cyrillic е instead of Latin e). A 2025 Microsoft Teams phishing campaign used micros0ft-teams.net — one character different from the real domain — and deceived thousands of users.
The check: Click or hover on the sender name to reveal the full email address. Then confirm the domain after the @ symbol matches the official domain exactly — character by character.
🚩 Red Flag 2 — The Email Creates Urgency or Fear
Urgency and pressure are deliberate psychological tools
Risk Level: Very High — Present in virtually all phishing attacks
Phishing emails are not primarily a technical attack. They are a psychological one. The reason attackers create urgency — "your account will be closed in 24 hours", "immediate action required", "your payment has failed" — is deliberate and evidence-based: the more pressured someone feels to act quickly, the less likely they are to stop and think critically about what they are being asked to do.
The most common urgency triggers used in phishing emails include:
- Account suspension threats: "Your account has been compromised and will be locked unless you verify your details now"
- Payment failure: "Your payment of £X has failed — update your billing details to avoid service interruption"
- Tax and legal threats: "Failure to respond within 48 hours may result in legal action" (HMRC-impersonation scams)
- Time-limited offers: "Your refund/reward expires today — claim it now"
- Security alerts: "Unusual sign-in activity detected — secure your account immediately"
💡 The urgency rule
Any email that pressures you to act within hours — regardless of who it appears to come from — should be verified through a completely separate channel before you take any action. Call the organisation directly using a phone number from their official website. Log into the service directly by typing the URL yourself. Never use the contact details or links provided in the suspicious email itself.
🚩 Red Flag 3 — The Link Goes Somewhere Different
The displayed link text and actual destination are different
Risk Level: Very High — The most direct path to credential theft
A clickable link in an email has two parts: the anchor text (what you see) and the actual URL (where it actually takes you). These can be completely different. Phishing emails routinely display a legitimate-looking URL — "Click here: www.barclays.co.uk/login" — while the actual link destination is a fake page on a completely different domain.
On desktop: Hover your mouse over any link before clicking. The actual destination URL appears in the bottom left of your browser or email client. If it differs from what the link text displays — or if it uses a shortened URL like bit.ly, or a domain you do not recognise — do not click.
On mobile: Press and hold on the link. Most email apps show a preview of the actual URL destination before you commit to opening it.
⚠️ Hovering alone is no longer sufficient in 2026
Attackers now use URL redirection — a technique used in 48% of phishing links — where the initial URL looks legitimate but redirects through a chain of pages to the final malicious destination. File-hosting services (Google Drive, SharePoint, Dropbox) are used in 26% of phishing links — the initial URL is a real, trusted service, but the file it hosts contains the malicious content. Always verify the final destination and the context of why you are being asked to open it.
The check: If you receive an unsolicited email asking you to log in anywhere, do not use the link at all. Open a new browser tab and navigate to the service directly by typing the address. Log in there. If there is genuinely an issue with your account, you will see it — without having exposed your credentials to a phishing page.
🚩 Red Flag 4 — An Unexpected File Attachment
Any attachment you were not specifically expecting is potentially dangerous
Risk Level: High — Common vector for ransomware and malware
File attachments in phishing emails are one of the primary delivery mechanisms for ransomware and malware. In 2026, the most dangerous attachment types are not the obvious ones — no sophisticated attacker sends a .exe file labelled "CLICK ME". The dangerous ones are dressed as legitimate business documents.
| Attachment Type | % of Malicious Attachments | Risk |
|---|---|---|
| ZIP / RAR archives | 62% | Very High |
| Word documents (.docm/.docx) | 16% | High — especially if macros are enabled |
| HTML files | 12% | High — can create fake login pages locally |
| Excel spreadsheets (.xlsx) | 10% | Medium-High — macro-based attacks |
| PDF files (with embedded QR or links) | Rising | Medium — used increasingly after Microsoft macro blocks |
The rule: If you were not specifically expecting a file from this person, treat it as suspicious — regardless of who sent it. Verify with the sender through a separate channel (call or text them directly, not by replying to the email) before opening. Never enable macros in an Office document unless you know with certainty why they are required and who sent the file.
🚩 Red Flag 5 — Generic OR Unnaturally Specific Greetings
Greetings that are too vague — or too personal — can both be a tell
Risk Level: Medium — Useful indicator but not definitive alone
Older phishing guidance correctly pointed out that "Dear Customer" or "Dear User" instead of your actual name was a phishing indicator. This remains partially true — but the evolution of phishing in 2026 has complicated the picture in both directions.
Generic greetings ("Dear Account Holder", "Hello", "Dear Valued Customer") suggest a mass-send phishing campaign where the attacker does not have your name. Still relevant — a bank that has your name will use it.
Suspiciously specific greetings can also be a tell in the opposite direction. Spear phishing emails now routinely include your full name, job title, company name, and sometimes references to recent activity — all scraped from LinkedIn, company websites, and data breaches. An email that seems unnervingly well-informed about your specific situation should trigger heightened scrutiny, not reassurance.
💡 The greeting alone proves nothing either way
Use the greeting as a contextual signal alongside the other red flags — not as a standalone verdict. An email with your correct name, correct job title, and correct company name can still be phishing. Verify the sender address and link destination regardless of how accurately the email addresses you.
🚩 Red Flag 6 — It Asks for Your Password or Login Details
No legitimate organisation will ever ask for your password by email
Risk Level: Very High — Single most reliable phishing indicator
This is the single most reliable rule in phishing detection, and it has no exceptions: no legitimate organisation — not your bank, not Microsoft, not Google, not HMRC, not your IT department — will ever ask you to provide your password, PIN, or full login credentials via email.
The same applies to variations of this request: emails asking you to "confirm your identity" by entering your password, emails directing you to a page that asks you to "verify your account" by logging in, and emails from apparent IT support asking for your current password to "reset" or "upgrade" your account. All of these are phishing.
Legitimate services reset passwords through a process that does not require you to reveal your current password at any point. Legitimate banks verify your identity through their own app or by asking knowledge-based questions you set up yourself — not by asking for your online banking PIN over email.
🚨 If an email asks for your password — stop immediately
Do not continue. Do not click any link in the email. Report it to your IT support (if at work) or to the NCSC at report@phishing.gov.uk. Log into the service the email claims to be from by navigating directly to the real website — and confirm your account is secure.
🚩 Red Flag 7 — The Branding Doesn't Quite Look Right
Subtle visual inconsistencies that reveal impostor emails
Risk Level: Medium — Requires close attention; AI is narrowing this gap
Phishing emails impersonating well-known brands — Microsoft, PayPal, Amazon, HMRC, Royal Mail, major UK banks — frequently use copied logos, colour schemes, and email templates. The quality varies: some are essentially pixel-perfect; others have subtle tells that reveal them on close inspection.
- Slightly wrong logo colours or proportions: Brand colour values are precise — a slightly different shade of blue on an HSBC email is a tell
- Inconsistent font weights: Real corporate emails use a specific typeface applied consistently; phishing versions often mix fonts or weights incorrectly
- Low-resolution imagery: Logos that look slightly blurry or pixelated compared to crisp originals
- Email footer inconsistencies: Legitimate corporate emails have precise legal disclaimers and registered address information; phishing versions often have vague or missing footers, or footers that do not match the claimed organisation
- Broken or missing formatting on mobile: Legitimate transactional emails are built by professional design teams and render correctly; phishing templates often break on mobile views
Compare any suspicious email to a previous genuine email from the same organisation. Visual comparison is often the fastest way to spot an impostor.
🚩 Red Flag 8 — It Asks You to Bypass Normal Process
CEO fraud, invoice redirect, and process-bypass requests
Risk Level: Very High — Most financially damaging phishing type for UK businesses
Business Email Compromise (BEC) — also called CEO fraud or invoice redirect fraud — is the most financially damaging type of phishing for UK small businesses. Unlike mass phishing, BEC is targeted and researched. The attacker studies the organisation's structure, identifies who has payment authority, and crafts a highly convincing email to that person.
The tell is consistent across almost all BEC attacks: the email asks you to bypass a normal process. It might be:
- An email appearing to be from your MD or CEO asking for an urgent bank transfer to an unfamiliar account — "I'm in a meeting, can't call, please transfer £X now"
- A supplier email stating their bank details have changed and asking you to update your payment records before the next invoice
- An IT email asking you to approve an urgent payment or bypass a security step "just this once" due to a system issue
- An HR email asking you to update an employee's bank details for payroll — supposedly from the employee
I'm in a board meeting and need you to process an urgent payment of £18,500 to a new supplier we're onboarding today. This is time-sensitive — can you do this before 3pm? I'll explain more later. Please keep this between us for now.
Details to follow. Let me know you can do this first.
James
What's wrong: Domain has a double 'm' — companynamme.co.uk. Requests secrecy ("keep this between us"). Creates artificial urgency. Real executives use verified internal communication for payments — not secretive one-line emails.
✅ The defence: a verbal confirmation rule
The most effective protection against BEC is a standing policy: any request to transfer funds, change bank details, or modify payment records must be verbally confirmed — by phone call to a known number — before action is taken. No exception. Not for urgency. Not for seniority. Not for "the CEO said so in an email." One phone call has prevented enormous financial losses for thousands of UK businesses.
🚩 Red Flag 9 — Unexpected Refunds, Tax Rebates, or Prize Notifications
Offer-based phishing — exploiting positive emotions too
Risk Level: High — Highly effective against people who don't associate good news with danger
Not all phishing creates fear — some creates excitement or pleasant surprise. HMRC tax refund scams are among the most frequently reported phishing attacks against UK individuals and small businesses. The pattern is consistent: an email claims you are owed a refund of a specific, believable amount (£200–£900 is most common — enough to seem real, not so much it seems too good to be true), and directs you to a fake HMRC portal to "claim" it by entering your bank details.
Other common variants include:
- Parcel delivery failed: "Royal Mail attempted delivery — pay £2.49 to rebook" — a small payment request designed to harvest card details
- Energy rebate schemes: Impersonating Ofgem or energy suppliers with refund offers
- Business grant notifications: Particularly effective against small business owners — fake HMRC, Innovate UK, or local authority grant emails
- Lottery or competition wins: Less sophisticated but still widely used — "You've been selected for a £500 Amazon gift card"
The rule: HMRC does not offer refunds by unsolicited email. If you are owed a tax refund, it will appear in your Personal Tax Account or HMRC online portal — not in an email asking for bank details. Log in directly at gov.uk/personal-tax-account to check your status.
🚩 Red Flag 10 — QR Codes in Emails (Quishing)
QR code phishing bypasses email security filters completely
Risk Level: High — A fast-growing 2025–2026 attack vector with no filter protection
QR code phishing — known as quishing — has grown dramatically since 2025, directly linked to Microsoft's policy of blocking malicious macro-enabled Office files. Unable to use file attachments reliably, attackers pivoted to embedding QR codes in PDF attachments or directly in email bodies. When scanned, the QR code takes the victim to a phishing page — but because email security filters scan URLs in text, not images, the malicious link is invisible to security software.
Quishing emails typically impersonate multi-factor authentication prompts ("Scan this QR code to verify your Microsoft 365 identity"), package delivery tracking, or shared document access.
⚠️ QR codes in emails are almost always suspicious
Legitimate services that use QR codes — two-factor authentication apps, banking apps, event ticketing — generate them in their own apps or on-screen portals, not in unsolicited emails. A QR code embedded in an unexpected email should be treated with the same suspicion as a link. Before scanning, ask: did I initiate an action that would logically require a QR code response? If not, do not scan it.
🚩 Red Flag 11 — The Email Comes From a Contact You Know
57% of phishing comes from compromised legitimate accounts
Risk Level: Very High — The hardest category to detect reliably
Over 57% of phishing emails in 2026 are sent from compromised legitimate accounts — not fake addresses. This means the email genuinely comes from your supplier's real email address, your client's real inbox, or a colleague's actual account — because that account has been silently compromised by an attacker who is using it to phish the victim's contacts.
This is the hardest category of phishing to spot because the sender address passes every check — it genuinely is who it claims to be. The attacker often waits, reads the compromised account's email history, and then crafts a reply in an existing thread — making the phishing email look like a natural continuation of a real conversation.
The tells to look for when the address itself is legitimate:
- Behavioural inconsistency: The email asks for something this person has never asked for before — a payment, a file, account credentials
- Slight tone change: The writing style feels slightly different from their usual communications — more formal, more urgent, less specific to your relationship
- Unexpected context: A supplier suddenly sending a payment redirect. A client suddenly attaching a document out of nowhere. A colleague asking you to "take a look at this" with a link
- A request that does not match the thread history: If an ongoing email thread suddenly pivots to a payment request or bank detail change, that is a major warning sign
The defence: Any request that involves money, credentials, or sensitive action — even from a known, verified address — should be confirmed verbally or through a separate channel before acting.
🚩 Red Flag 12 — The Email Is Perfectly Written (And That's the Problem)
AI-generated phishing — when flawless writing is a warning sign
Risk Level: Very High — The defining challenge of phishing in 2026
For years, one of the most reliable phishing indicators was poor language: spelling mistakes, awkward phrasing, unusual sentence constructions, and grammatical errors that no native English speaker would produce. That indicator is now largely obsolete. In 2025, 82.6% of phishing emails were AI-generated — a 53.5% increase year on year. AI-written phishing emails are not just grammatically correct. They are stylistically natural, contextually appropriate, and tonally accurate to the organisation they are impersonating.
More alarmingly, AI tools now allow attackers to generate personalised phishing at scale — emails that reference your actual name, role, company, recent LinkedIn activity, or public news about your organisation — in minutes. A 2025 academic study found that AI-crafted phishing emails achieved a 54% click rate compared to just 12% for human-written ones.
The implication is significant: you can no longer use language quality as a phishing detector. A perfectly written email is not evidence of legitimacy. The technical checks — sender address, link destination, request type — become even more critical when the content itself gives no language-based signal of threat.
💡 What to use instead of grammar checking
Shift your evaluation from content quality to contextual legitimacy. Ask: Did I initiate the interaction that this email is responding to? Does this request fit normal process for this organisation? Is there any pressure to act quickly or secretly? Would I be comfortable calling this person to confirm before acting? These questions catch AI phishing that perfect grammar cannot.
The Most Common Phishing Types Targeting UK Businesses in 2026
| Phishing Type | How It Works | Primary Target | Risk to SMEs |
|---|---|---|---|
| Email phishing (bulk) | Mass emails impersonating banks, HMRC, Microsoft, Royal Mail, delivery services | Everyone with an email address | Medium |
| Spear phishing | Targeted, researched attacks on specific individuals using personal details | Business owners, finance leads, IT admins | High |
| CEO fraud / BEC | Impersonates senior staff to authorise payments or change bank details | Finance staff, anyone with payment authority | Very High |
| Invoice redirect fraud | Intercepts or impersonates supplier emails to redirect payments to attacker accounts | Businesses with regular supplier payments | Very High |
| HMRC impersonation | Fake tax refunds, tax debt threats, VAT compliance emails | Self-employed, company directors | High |
| Quishing (QR phishing) | QR codes in PDFs or emails that bypass security filters | Microsoft 365 and cloud account users | Medium-High |
| Compromised account phishing | Attacker uses a hacked trusted account to send phishing to its contacts | Anyone in the victim's contact network | Very High |
What to Do If You Clicked a Phishing Link
Immediate Response Steps — Act Fast, Stay Calm
The first 30 minutes after clicking a phishing link matter most
Clicking a phishing link does not automatically mean you have been compromised — but it requires immediate action to prevent potential damage from becoming actual damage. Do not panic. Do act quickly.
IMMEDIATE RESPONSE — IN ORDER
- Do not enter any information on any page that opened. Close it immediately without typing anything.
- Disconnect from the internet if you suspect malware may have been downloaded — turn off Wi-Fi and unplug the ethernet cable. This limits any installed malware's ability to communicate with its command server.
- Change the password for the account the email was impersonating — do this on a separate, clean device, not the one you clicked on. Change it immediately before the attacker can lock you out.
- Enable two-factor authentication on the affected account if it is not already active. This prevents the stolen password alone from being used to access the account.
- Run a full malware scan using your security software on the device you clicked on. Do not continue using it for sensitive tasks until it has been cleared.
- Notify your IT support or manager if this happened on a work device. Security incidents need to be escalated immediately — your IT team can assess the scope of any compromise before it spreads.
- If you entered bank or payment details: Call your bank immediately using the number on the back of your card. Report the incident and ask for your account to be monitored or temporarily frozen if necessary.
- Report the phishing email to the NCSC at report@phishing.gov.uk — takes under one minute and helps protect others.
✅ If you only clicked but did not enter anything
If you clicked a link but immediately closed the page without entering any information, the risk is significantly lower. Run a malware scan as a precaution — some phishing pages can attempt drive-by downloads — but credential theft requires your input, not just a page visit. Monitor the relevant accounts for unusual activity over the following week.
Protecting Your Business — Beyond Just Spotting Them
Individual vigilance is essential — but for a business, it cannot be the only layer of defence. One moment of distraction, one new team member, one convincing spear phishing email is all it takes. These are the technical and procedural controls that reduce your business's phishing risk at the organisational level.
Phishing Protection Checklist for UK Small Businesses
Technical Controls
- Enable Multi-Factor Authentication (MFA) on every business account — Microsoft 365, Google Workspace, banking portals, cloud tools. MFA means a stolen password alone cannot access the account. This single control neutralises a large proportion of phishing attacks' intended outcome.
- Use a password manager — tools like Bitwarden (free) or 1Password prevent password reuse across accounts, so one compromised credential does not cascade. Password managers also refuse to autofill on fake domains — a silent secondary phishing check.
- Enable your email provider's anti-phishing settings — Microsoft 365 Defender and Google Workspace both have anti-phishing and suspicious link scanning settings that are not always enabled by default. Check and activate them.
- Configure DMARC, DKIM, and SPF on your business email domain — these email authentication standards prevent attackers from sending emails that appear to come from your domain. 41% of organisations lack DMARC protection. A Workvera digital advisory session can help you check and configure this.
- Keep all software and operating systems updated — browser and email client updates patch known phishing and malware vulnerabilities. Outdated software is a standing open door.
Process Controls
- Payment verification rule: Any request to transfer funds or change bank details — regardless of who it appears to come from — must be verbally confirmed via a known phone number before processing. No exceptions.
- New supplier bank detail verification: Before making a first payment to any new supplier, call a known number to confirm their bank details independently of any emailed invoice.
- Incident reporting culture: Make it easy and consequence-free for team members to report suspected phishing. The faster a phishing attempt is flagged, the faster it can be assessed and blocked. Organisations with clear reporting processes see 21% phishing reporting rates versus 5% without them.
Human Controls
- Regular awareness: Brief, regular reminders about phishing patterns outperform annual compliance training. Share examples of current phishing campaigns targeting UK businesses when they appear in the news.
- Phishing simulation: Services like Proofpoint and KnowBe4 offer simulated phishing campaigns that test your team's recognition in a safe environment. Organisations with regular training see click rates drop to as low as 1.5%.
- New staff induction: Phishing awareness training on day one — before a new team member has access to any sensitive systems — closes the most vulnerable window in your organisation's security posture.
No combination of controls is perfect — but layered technical, process, and human defences reduce phishing success rates dramatically. Organisations with all three layers in place consistently outperform those relying on any single control alone.
How to Report a Phishing Email in the UK
Reporting phishing attempts actively helps the NCSC take down phishing sites and reduces the number of other people caught by the same campaign. It takes under two minutes and has real impact.
UK Phishing Reporting Contacts — Bookmark These
NCSC general phishing: Forward any phishing email to report@phishing.gov.uk — the National Cyber Security Centre's Suspicious Email Reporting Service. This address has received over 36 million reports and taken down over 250,000 scam URLs since launch.
HMRC impersonation scams: Forward to phishing@hmrc.gov.uk — HMRC's dedicated phishing reporting address for emails falsely claiming to be from HMRC.
Financial fraud or BEC with financial loss: Report to Action Fraud at actionfraud.police.uk or 0300 123 2040 — the UK's national reporting centre for fraud and cybercrime.
Banking credential theft: Contact your bank directly using the number on the back of your card — and separately report to Action Fraud.
Gmail: Use the "Report phishing" option in the three-dot menu next to the email. This also flags the sender to Google for investigation across Gmail.
Microsoft Outlook: Use the "Report" button or forward to reportphishing@microsoft.com for emails impersonating Microsoft products or services.
The best phishing protection includes using secure, well-configured tools from the start. Read: Best Free Tools to Run a Small Business Digitally in 2026 — including the security tools that help protect your business at no cost.
Protecting your business online also means being visible to the right people. Read: How to Get Your Business Found on Google in 2026 — the complete guide to local search visibility for small UK businesses.
Frequently Asked Questions
How do I know if an email is a phishing scam?
The most reliable indicators in 2026 are technical rather than content-based — since AI has eliminated grammar errors as a reliable tell. Check the actual sender email address (not just the display name) and verify it matches the official domain exactly. Hover over any links to confirm they point to the real organisation's domain. Ask whether the email is requesting something a legitimate organisation would actually ask for by email — especially passwords, payments, or bank detail changes. Any urgency or pressure to act immediately should trigger verification, not compliance.
What should I do if I clicked a phishing link?
Act immediately: close any page that opened without entering any information. If you suspect a malware download, disconnect from the internet. Change the password for the account the email was impersonating from a different, clean device. Enable two-factor authentication on that account. Run a full malware scan on the device you used. If banking details were entered, call your bank immediately using the number on the back of your card. Report the email to the NCSC at report@phishing.gov.uk. If it happened on a work device, notify your IT support immediately.
Can you get hacked just by opening a phishing email?
Simply opening a phishing email is very low risk for most users with updated email clients and browsers. The danger comes from the actions the email tries to persuade you to take — clicking links, opening attachments, entering information on fake pages. HTML emails can in rare cases trigger tracking pixels or exploit browser vulnerabilities, but keeping your software updated eliminates this risk. The primary threat from phishing is always the social engineering — what the email tries to get you to do — not the act of opening it.
Are AI phishing emails harder to spot than regular ones?
Yes — significantly. 82.6% of phishing emails are now AI-generated, with a 2025 study finding AI-crafted emails achieve a 54% click rate versus 12% for human-written ones. AI removes the language errors that once made phishing easy to identify. In 2026, spotting phishing means checking technical signals — sender addresses, link destinations, and request legitimacy — rather than relying on grammar quality. An email can be perfectly written and still be a phishing attack. Shift your evaluation from content quality to contextual legitimacy.
How do I report a phishing email in the UK?
Forward any suspicious email to report@phishing.gov.uk — the NCSC's free Suspicious Email Reporting Service that has taken down over 250,000 phishing URLs since launch. For HMRC impersonation specifically, forward to phishing@hmrc.gov.uk. For financial fraud or losses from BEC attacks, report to Action Fraud at actionfraud.police.uk or 0300 123 2040. Gmail and Outlook both have built-in phishing report buttons that simultaneously flag the sender to the email provider. Reporting takes under two minutes and helps protect other UK users from the same campaign.
Worried about your business's exposure to phishing and cyber threats?
Workvera's digital advisory service helps UK small businesses assess their digital security posture — identifying vulnerabilities, configuring email protection settings, and building the practical habits that prevent phishing attacks from succeeding.
Book a Digital Security Review