Pause before the message becomes a decision.

01 / In practice

A familiar name is not enough.

Phishing is an attempt to persuade someone to reveal information, sign in to an unsafe service or take an action that benefits an attacker. A message can look professional and still be deceptive. It may impersonate a supplier, colleague or well-known service.

The useful habit is to pause when a message creates urgency, changes payment details or asks for unusual access. Appearance, spelling and a familiar logo are clues, not proof that the request is genuine.

02 / In practice

Before you click, pay or sign in.

Use these checks as a prompt for judgement, especially when a request affects money, credentials or sensitive information.

• Were you expecting the request, attachment or change?
• Does the actual sender address make sense, beyond the display name?
• Is the message pushing you to bypass the usual process?
• Can you verify the request through a known independent contact route?
• Can you open the service through your own saved address instead of the message link?

03 / In practice

Verify changes outside the message.

For a bank-detail change or unusual payment, contact the person using a number or route you already trust. Do not rely on a new telephone number or reply address supplied in the same message. Follow the business's approval process even when the request appears to come from someone senior.

If you need to inspect a destination link, avoid opening it just to find out. Device interfaces vary, and previewing information does not guarantee safety. When unsure, stop and use the agreed reporting route.

04 / In practice

Make reporting easy.

People should be able to report a concern without feeling foolish for asking. Useful details include when the message arrived, what it requested and whether anybody clicked, entered information or made a payment. Do not forward potentially harmful attachments casually to other colleagues.

If you think an account or device may already be affected, follow your existing support or incident arrangements promptly. Explain the actions taken so far. Financial loss or suspected fraud may also require the relevant bank or authority route; technical support is only one part of the response.

05 / In practice

Use protection as another layer.

Email filtering and account protection add useful layers alongside independent verification. Keep a known contact route and a clear payment-approval process available, so a convincing message does not become an unchecked decision.

A useful business approach combines suitable tools, clear authorisation rules and a calm reporting process. Review those arrangements before an incident rather than relying on everybody to improvise under pressure.