Phishing: stop before you act
Modern phishing can look completely professional. Concentrate on the request, the destination and the consequences rather than spelling mistakes.
Last reviewed: October 2026
Phishing is no longer reliably identified by bad spelling, crude graphics or an obviously strange sender. Messages can be polished, timely and tailored to your work. They may arrive by email, text, social media, collaboration tools, calendar invitations, QR codes or phone calls.
The useful question is not “Does this look genuine?” but “Is it asking me to do something that deserves checking?”
Slow down at the point of action
Pay particular attention when a message asks you to:
- sign in or reset a password;
- open an unexpected attachment;
- scan a QR code;
- approve a login or MFA prompt;
- install software;
- change bank or payment details;
- send confidential material; or
- act urgently or secretly.
A convincing sender name or familiar logo proves very little.
Avoid the link when you can
If a message says there is a problem with Microsoft 365, Google, Dropbox, a social network, a bank or another service you already use, open the service yourself using its app, a bookmark or a known address. Do not use the message as your route to the login page.
On a computer, hovering over a link can reveal its destination, but attackers use lookalike domains and compromised legitimate sites, so link inspection is not foolproof. QR codes deserve the same caution as clickable links, particularly when they arrive in an email.
Verify unusual requests another way
If a producer, executive, supplier or contributor apparently makes an unusual request, confirm it using a separate channel you already trust. Do not rely on contact details supplied in the suspicious message.
This is especially important for changes to payment instructions, requests for credentials, sensitive documents or requests that break normal procedure.
Let your password manager help
A password manager will normally recognise the genuine site for an account. If it unexpectedly refuses to offer the saved password, stop and check where you are rather than manually typing the password into the page.
Passkeys offer even stronger protection because they are designed to resist phishing.
If you clicked
Do not panic and do not conceal it. Report it promptly.
If you entered a password, change it from a trusted device and tell whoever manages the account. If that password was reused anywhere else, change those accounts too. Review active sessions and recovery details.
If you approved an unexpected authentication request, installed software or opened a suspicious file, contact your IT/security support promptly and leave the device available for investigation.
The goal is not to distrust every message. It is to build a habit of checking the relatively small number that ask you to do something consequential.