The safest way to check an unexpected email from your bank is not to use the email itself. Don’t click its links, open unexpected attachments or reply. Instead, contact the bank using a phone number or website you find independently, such as the number on your bank card or statement.
That simple pause also works for messages from suppliers, customers and colleagues. Phishing emails can look convincing, so a sensible checking process matters more than expecting everyone to spot every scam. October’s Cyber Security Awareness Month is a useful reminder for SMEs and growing businesses across Devon to review that process.
What to check in an unexpected email
Phishing is an attempt to use a message to persuade someone to visit a harmful website, share sensitive information or make a payment. The sender may pretend to be a bank, supplier, senior colleague or public organisation.
Look for signs that deserve a closer check:
- An unexpected request to sign in, confirm account details, pay an invoice or change supplier bank details.
- Pressure to act quickly, such as a threat of account closure or a short payment deadline.
- A sender address that doesn’t quite match the organisation’s usual domain. Check the full address, not just the display name.
- A link or attachment you weren’t expecting. A familiar logo or polished layout doesn’t prove that a message is genuine.
- A QR code in an email asking you to scan it to sign in or view a document.
These are prompts to pause, not a test with a perfect checklist. As the National Cyber Security Centre (NCSC) notes, scams are getting smarter and “some even fool the experts”. Spelling mistakes can be a clue, but well-written messages can be fraudulent too.
Check the sender and link without clicking
A sender’s display name is easy to copy. If a message appears to come from your bank, inspect the full email address and compare its domain with one used in previous genuine messages. A lookalike spelling or an unexpected email provider is a reason to verify independently.
You can also preview a link without opening it. On a computer, hovering over it may show the destination address; on a phone, use care and avoid tapping through. A link preview is only a clue, not proof that a message is safe. If you have doubts, open the bank’s app or type its known web address yourself instead.
Don’t use the phone number, reply address or website link in the suspicious email to check it. Find the organisation’s contact details from a source you already trust. For an email that seems to come from a colleague or supplier, use a known phone number or another established channel.
Treat payment and bank-detail changes as a separate check
Email is convenient for invoices and routine requests, but it should not be the only approval route for a change that could move money. A compromised mailbox can make a fraudulent request look like part of an ordinary conversation.
For payment requests and supplier bank-detail changes, agree a process that your team can follow every time:
- Verify the request through a separate channel, using a phone number already on file rather than one in the email.
- Speak to a known contact and confirm the details verbally. Don’t rely on a new number supplied with the request.
- Use a second approver for changes or payments where practical, following your organisation’s finance controls.
- Record the verification in your usual accounts process, so there is a clear audit trail.
This is not about slowing every transaction down. It is about making an important change harder to approve solely because a message looks familiar.
Make reporting easy for your team
Staff should know what to do when a message feels unusual, including when they are unsure whether it is malicious. A clear internal rule could be:
Don’t click. Verify independently. Report it to our IT or security contact.
Tell people where to send suspicious messages and how to report an accidental click. If your organisation uses Microsoft 365, an administrator can review the NCSC’s guidance on configuring Outlook’s Report Phishing add-in.
You can also forward suspicious emails to the NCSC at report@phishing.gov.uk. The NCSC accepts messages you are unsure about. Don’t click links in the email first.
A blame-free approach helps here. Someone who reports a mistake quickly gives the business a better chance to respond. The NCSC’s guidance for organisations defending against phishing recommends combining technical controls, clear processes and supportive reporting rather than relying on staff to identify every suspicious message.
Add protection beyond the inbox
Staff awareness is important, but it is only one part of cyber security. Email filtering, account security and device maintenance can help reduce the chance that a single click becomes a wider problem.
Useful measures to review include:
- Multi-factor authentication (MFA) on email, finance and other important accounts. This adds a further check beyond a password.
- Supported, up-to-date software and devices, so known security weaknesses are addressed.
- Email filtering and anti-malware protection, configured to suit how your organisation works.
- Restricted access, giving people only the permissions their roles require.
- Backups and an incident plan, so staff know who to contact and how to protect business information if something goes wrong.
Technical measures can reduce risk, but no single tool confirms that every email is genuine. Filtering may catch some harmful messages, while multi-factor authentication can help protect an account if a password is exposed. A sensible plan layers these measures with independent checks and a quick reporting route.
For a small organisation that wants a structured starting point, the NCSC’s free Cyber Action Toolkit provides practical steps. ABC Service also provides business IT support for organisations across Tavistock, Plymouth, Okehampton and the surrounding area. The useful first step is to identify which protections and procedures your business already has, and where a simple change could make them clearer.
If someone has clicked or shared information
Act promptly, and focus on limiting access rather than working out who is at fault.
- Tell your internal IT contact or IT provider straight away. Include what was clicked, downloaded or entered, and when it happened.
- If a password was entered, change it using the genuine service on a trusted device and review sign-in sessions where that option is available. Tell IT if the password is used elsewhere.
- If a payment was made or bank details were shared, contact the bank using its independently verified details as soon as possible.
- If a file was downloaded or software installed, stop using the affected device for sensitive activity and ask IT for advice.
- Report a suspicious email to the NCSC. If you have lost money or believe a crime has taken place in England, Wales or Northern Ireland, follow the NCSC’s advice to report it through Report Fraud.
The right response depends on what happened. Prompt reporting gives your organisation a better chance to secure accounts, check systems and decide what else needs to be done.
A practical takeaway for October
When a message claims to be from your bank, don’t decide by appearance alone. Pause, avoid its links and attachments, and check the request through contact details you obtain independently. For payments and bank-detail changes, verify through a separate known channel and follow your approval process.
Make it easy for everyone in the organisation to report anything that feels wrong, even if they have already clicked. That combination of clear habits, technical safeguards and prompt support is more useful than expecting staff to spot every phishing email on sight.