Spotting phishing emails

Most attacks on small businesses start with an email. It looks like an invoice, a parcel notification or a message from the bank – and wants you to click, sign in or open a file. A good spam filter catches most of these emails before they ever reach your inbox. But no filter is fully reliable – so it pays to know the warning signs.

Five warning signs

• The sender doesn’t match: the name is right, the address behind it isn’t.
• Pressure and urgency: “Your account will be locked today”, “Final reminder”.
• Links lead elsewhere: hover over them before you click.
• Unexpected attachments, especially Office files with macros or ZIP archives.
• Requests to enter passwords or payment details.

What you can do

When in doubt, don’t click – contact the sender another way, by phone or via a website you open yourself. Turn on two-factor sign-in wherever possible: then a stolen password alone isn’t enough.

Technology helps on top: with our web hosting and grommunio, our spam filter checks incoming email for phishing and malware before it reaches you. With Microsoft 365, we can add it in front of Microsoft’s own filter on request. A few emails will still slip through – which is why the warning signs above still matter.