How to spot a phishing email: a checklist for small businesses

Phishing emails pretend to be from someone you trust so that you click a link, open an attachment, enter a password or make a payment. Small businesses are targeted because they handle invoices and payments, often without an IT team to double-check.

Common types aimed at businesses

• Fake invoices and remittances with a link or attachment to "view the document".
• Password and mailbox warnings claiming your Microsoft 365 or Gmail storage is full or your password is expiring.
• Changed bank details from a supplier asking you to pay into a new account.
• Boss or colleague requests for an urgent payment or gift cards.
• Delivery and domain notices asking for a small fee to release a parcel or renew a domain.

The checklist

1. Check the real sender address, not just the name. "Microsoft" sending from a random domain is a warning sign.
2. Hover over links before clicking. If the web address doesn't match the company, don't click.
3. Be wary of urgency. "Within 24 hours", "final notice" and "account suspended" are designed to rush you.
4. Question unexpected attachments, especially invoices you weren't expecting.
5. Never enter your password after clicking an email link. Go to the website directly instead.
6. Confirm any change of bank details by phone, using a number you already have, not one in the email.
7. Look for small spelling tricks in the address, such as m1crosoft or paypa1.

If you clicked or replied

• Change the password for that account straight away, and anywhere else you use it.
• Turn on two-factor authentication if it isn't already on.
• If you made a payment or shared bank details, call your bank immediately.
• Check your mailbox for new forwarding rules you didn't create, a common trick after an account is taken over.

Reporting phishing in the UK

Forward suspicious emails to the National Cyber Security Centre's reporting service at report@phishing.gov.uk. In Outlook and Gmail you can also use the built-in "Report phishing" option, which helps protect other people.

Protecting your inbox

A checklist helps, but it relies on everyone being careful every time. Optima Mail Guard adds a second line of defence: it moves phishing, scams and cold sales email out of your inbox as they arrive, into a separate folder you can check whenever you like. Nothing is deleted, and it works with Microsoft 365, Outlook, Gmail and most other business email. Start a free trial.