Phishing is an email, text or message that pretends to be from someone you trust in order to steal your passwords, money or data. For UK small businesses, it’s consistently the most common type of attack, because it targets people rather than technology, and it only needs to work once.
The classic warning signs
- Urgency or pressure. “Your account will be closed today”, “Invoice overdue”, “Final warning”.
- An unexpected request. To log in, pay an invoice, change bank details or open an attachment you weren’t expecting.
- A sender address that’s nearly right. Look at the actual address, not just the name. A real domain with one extra letter is a common trick.
- Links that go somewhere else. On a computer, hover over a link to see where it really goes before you click.
- Generic greetings such as “Dear customer”, from a company that knows your name.
The newer tricks
Phishing has become more convincing. Messages are now often well written, with no spelling mistakes, and AI makes it easy to tailor them to your business. Some of the current tactics:
- Fake login pages hosted on real services. In October 2026, researchers described fake job-interview pages built on a genuine scheduling platform that stole Facebook and Google logins.
- Login pages that capture two-factor codes in real time, as you type them.
- “Your domain is expiring” or “your hosting is suspended” emails designed to look like they come from your web host.
- Changed bank details on an invoice from a supplier whose email account has been taken over.
Five rules for your team
- Never change payment details because of an email. Phone the supplier on a number you already have.
- Don’t log in from a link in an email. Go to the website yourself.
- Use two-factor authentication everywhere you can. It stops most stolen passwords being used.
- Make it easy and blame-free to report a suspicious email. The person who clicked is your early warning.
- Protect your own domain with SPF, DKIM and DMARC so criminals can’t easily send email pretending to be you. See our guide.
If you clicked
Don’t panic, but act quickly. Change the password for that account, and anywhere else you used the same password. Turn on two-factor authentication. If you entered bank or card details, contact your bank straight away.
Where to report it in the UK
- Forward suspicious emails to the National Cyber Security Centre at report@phishing.gov.uk.
- Forward suspicious text messages to 7726.
- If you’ve lost money, report it to Report Fraud, the UK’s national fraud reporting service, which replaced Action Fraud.
Sources
Extra protection on the move
SilentSurf VPN encrypts everything you do on public Wi-Fi, for up to 10 devices.
