A phishing email is a fake message that pretends to come from someone you trust, so that you hand over passwords, bank details or access to your systems. For a small UK business, the warning signs are: a sender address that looks slightly wrong, pressure to act quickly, an unexpected link or attachment, and any request for money or login details. Check these four things first, every time.
Why small firms are the target
Criminals target small businesses because the payoff is easy. You have fewer staff, fewer checks and one person often handles money, email and admin. A scammer only needs one tired employee at 4:45 pm to click one link.
Large companies have security teams and strict payment approval chains. Most small firms do not. That is exactly why phishing, not hacking, is the way in for most attacks on small UK businesses.
The 7 red flags of a phishing email
Run through this list before you click anything.
- The sender address is close but not right. It might say HMRC but come from hmrc-refunds-support.com. Always read the full address, not just the display name.
- It creates urgency. “Pay within 2 hours or your account is suspended.” Urgency stops you thinking. Real organisations do not pressure you like this.
- The greeting is vague. “Dear customer” or “Dear business owner” instead of your name. A bank or HMRC knows who you are.
- It asks you to click a link or open an attachment you did not expect. Invoices you were not told about, delivery notices for parcels you did not order, password reset emails you did not request.
- It asks for money, login details or personal information. HMRC will never ask for your personal or payment details by email or text. Your bank will never ask for your full password.
- The language feels slightly off. Odd phrasing, grammar slips or US spellings in a supposedly British message are worth a second look. But beware: modern scam emails are often well written, so good grammar proves nothing.
- It moves a conversation to a new channel. “Reply to this personal email instead” or “message me on WhatsApp” is a classic trick to bypass your business email protections.
If even one red flag is present, stop and verify through a different channel before doing anything.
HMRC refund scams
This is the most common tax-season scam in the UK. You receive an email or text saying you are owed a tax refund and must click a link to claim it. The link goes to a fake HMRC page that harvests your bank details.
Remember two things. HMRC will never contact you by email or text to tell you about a tax refund. And any message asking you to “verify your details” to receive money from HMRC is a scam. Forward suspicious texts to 60599, which is HMRC’s dedicated reporting number.
Supplier bank-detail-change fraud
This one costs real money. A scammer impersonates a genuine supplier and emails you with “updated bank details” for your next payment. You pay the real invoice, but the money goes to the scammer.
The defence is simple and free: never change payment details on the strength of an email alone. Call the supplier on a number you already have, not one in the email, and confirm the change verbally. Add this rule to your payment process today.
The boss-requests-a-transfer scam
Also called business email compromise, this is when a criminal poses as your director or manager and asks for an urgent payment or gift card purchase. It often arrives late on a Friday, when the real boss is hard to reach.
One line defines it: business email compromise is fraud where a scammer impersonates a senior colleague to trick staff into moving money or sharing access. The fix is a standing rule: no payment ever moves on email instruction alone. Every request gets a phone call or a face-to-face check.
What to do in the first 5 minutes
If you or a colleague clicked a bad link or entered details, act fast and do not panic.
- Disconnect the affected device from the internet. Pull the cable or switch off Wi-Fi. This can stop malware spreading.
- Do not turn the computer off yet if IT support might need to investigate, but do stop using it for anything else.
- Change your passwords from a clean device, starting with email and banking. Email first, because email resets unlock everything else.
- Call your bank if any payment details were shared. Ask them to watch for suspicious transactions.
- Tell your team what happened, quickly and without blame. Shame keeps incidents hidden, and hidden incidents spread.
Consider this a good moment to read our guide to cybersecurity for remote workers, since home setups are a common weak point. For a structured defence, the Cyber Essentials scheme gives small firms five practical technical controls that cut phishing risk. And because some phishing leads to ransomware, keep reliable backups so you can recover without paying anyone: see our small business cloud backup guide.
How to report it: 7726, 60599 and the NCSC
Reporting helps take scam sites down and protects others.
- Suspicious texts: forward them free to 7726. Your mobile network investigates.
- Scam texts pretending to be HMRC: forward them to 60599 instead.
- Suspicious emails: forward them to report@phishing.gov.uk, the National Cyber Security Centre’s reporting service.
- If you lost money or shared financial details: report it to Action Fraud, the UK’s national fraud reporting centre.
Keep a copy of the original message before you delete it, in case you need it for a report.
Training your team without boring them
Awareness training fails when it is a yearly slideshow everyone clicks through. Try these instead.
- Send your team one real-looking example each month and talk through the red flags for two minutes. Real examples stick.
- Run a short phishing simulation with free or low-cost tools. The point is practice, not punishment.
- Make reporting easy and blame-free. A shared “is this legit?” channel in your team chat works better than a policy document.
- Celebrate the person who spots a scam, even a simulated one. You want a culture where checking is normal, not awkward.
Frequently asked questions
How can I check a link safely without clicking it?
Hover over the link to see the real address in the corner of your screen, or press and hold it on a phone. If the address does not match the organisation it claims to be, do not click. When in doubt, type the organisation’s website address into your browser yourself.
What should I do if I already clicked a phishing link?
Disconnect from the internet, change your passwords from a clean device (email first), and call your bank if you shared financial details. Then report the message to report@phishing.gov.uk and tell your team.
Will my bank refund me if I was scammed?
It depends on how the money left your account. Card payments and direct debits have stronger protections than bank transfers. Contact your bank immediately: the sooner you report, the better your chances. Never assume a refund is guaranteed.
Are phishing texts (smishing) as dangerous as phishing emails?
Yes. Texts feel more personal and are harder to inspect, which is why delivery and HMRC refund text scams work so well. Forward suspicious texts to 7726, or to 60599 for HMRC impersonations.
Can antivirus software stop phishing?
It helps, but it cannot stop you clicking. Email filters and antivirus catch many attacks, yet the clever ones still reach your inbox. Your judgement is the last line of defence, which is why training matters more than tools.
Conclusion
Spotting a phishing email comes down to a habit, not a skill. Check the sender, question the urgency, and verify through a separate channel before money or details move. Teach that habit to everyone in your firm and most phishing attempts will fail at the first click. Pick one action today: forward this checklist to your team, or add the call-to-confirm rule to your payment process.
