Phishing emails are the number one way criminals break into small business systems. According to the UK government’s Cyber Security Breaches Survey, phishing was the most common type of attack identified by UK businesses, and small companies are just as much at risk as large enterprises.
The good news? Once you know what to look for, most phishing attempts are surprisingly easy to spot.
A phishing email is a fraudulent message designed to trick you into revealing sensitive information — passwords, bank details, or login credentials — or into clicking a malicious link that installs malware on your device.
Attackers often impersonate trusted organisations: HMRC, Microsoft, your bank, or even a colleague or supplier.
Look carefully at the actual email address, not just the display name. A phishing email might show “HMRC — Do Not Reply” as the sender name, but the actual address could be `noreply@hmrc-refund-portal.net`.
Legitimate organisations always use their official domain (e.g. `@hmrc.gov.uk`).
Phishing emails create panic to make you act without thinking:
Genuine organisations rarely demand immediate action via email.
Hover over any link (without clicking) to see the real URL. If the link text says “Click here to verify your account” but the URL shown is something like `http://secure-microsoft-login.xyz/verify`, do not click it.
Never open attachments you weren’t expecting, especially `.zip`, `.exe`, `.doc` or `.pdf` files. Ransomware and malware are frequently delivered this way.
Professional organisations proofread their communications. Unusual phrasing, odd capitalisation, or clumsy sentences are classic phishing giveaways — though more sophisticated attacks are increasingly well-written.
No legitimate organisation will ask you to confirm passwords, banking details, or National Insurance numbers via email. Ever.
Generic greetings like “Dear Customer” or “Dear User” suggest a mass phishing campaign rather than a genuine communication from an organisation that knows you.
1. Don’t click anything — not links, not attachments, not unsubscribe buttons
2. Report it — forward to your IT support team or report to the NCSC at
3. Delete it from your inbox and Deleted Items folder
4. Tell your colleagues — if one person was targeted, others probably were too
Act fast:
1. Disconnect from the internet if you think malware may have been installed
2. Change your passwords immediately — especially for email, banking, and any accounts you access at work
3. Enable multi-factor authentication (MFA) on critical accounts
4. Contact your IT support team straight away — HGC IT is available 24/7
5. Report the incident to Action Fraud (www.actionfraud.police.uk)
Spotting phishing emails is important, but your business also needs layers of technical protection:
HGC IT provides comprehensive cybersecurity services for UK small businesses, including email filtering, MFA setup, and staff security awareness training. We also offer managed IT support to keep your systems protected every day.
If you’re concerned about your business’s exposure to phishing and other cyber threats, our team can carry out a free IT security review. We’ll identify the gaps and recommend practical, affordable steps to protect your business.
Get in touch: hello@hgcit.co.uk | hgcit.co.uk
