Lesson 2: Recognising Phishing Emails

Why This Matters

In Level 1 you saw that attackers target ordinary staff because it is easier to trick a person than to break into a system. Phishing email is the most common way they do it. A phishing email pretends to come from someone you trust, such as your IT team, a bank, HMRC or a supplier. It tries to get you to click, log in, open a file or send information.

Think of a phishing email as a stranger wearing a borrowed uniform. The uniform looks right at a glance, but the way they behave gives them away. This lesson shows you what that behaviour looks like and what to do when you spot it.

Know the Five Pressure Tactics

The UK's National Cyber Security Centre (NCSC) lists five signs that a message may be a scam. Learn them first, because almost every phishing email uses at least one.

1. Authority: it claims to come from someone official, such as your bank, a government department or your own IT team.
2. Urgency: it gives you very little time to act, such as "within 24 hours" or "immediately", often with a threat attached.
3. Emotion: it tries to make you panic, afraid, hopeful or curious.
4. Scarcity: it offers something in short supply, such as tickets, money or a limited deal.
5. Current events: it ties itself to the news, a big event or a time of year, such as the tax return deadline.

What to do: if you feel rushed or uneasy while reading an email, stop. That feeling is often the first warning sign.

Spot the Signs in a Real Example

Read this email the way you would on a busy Monday morning.

From: IT Service Desk it-support@secure-mailbox-update.co Subject: URGENT: Your mailbox will be deleted

Dear User,

Our records show your mailbox has exceeded it's storage limit. To avoid permanent loss of all emails, you must verify your account within 24 hours.

Click here to log in and verify: Verify My Account

Failure to act will result in suspension.

IT Department

Now work through it step by step:

1. Sender address: the name says "IT Service Desk", but the address is an outside domain, not your organisation's.
2. Generic greeting: "Dear User". Your real IT team knows your name.
3. Authority: it pretends to be your own IT department.
4. Urgency and threat: "within 24 hours", "permanent loss" and "suspension".
5. Emotion: fear of losing all your email.
6. Unexpected login request: it asks you to log in through a link in the email.
7. Small errors: "it's" should be "its", and the sign-off gives no name or contact details.

That is seven warning signs. You do not need to find all of them. One or two are enough to treat the email as suspicious.

Other signs to watch for:

• An attachment you were not expecting, especially with a vague message such as "Please see attached".
• A request to keep something secret or to skip the usual process.
• An offer that looks too good to be true, such as a refund or a prize.

Note: modern phishing emails can be well written, with no spelling mistakes. Pay more attention to the pressure tactics and the request than to the spelling. (Level 3 covers how to check links, senders and attachments in detail.)

Choose the Safe Action When Asked to Log In

An unexpected email asking you to log in is one of the most common traps. The fake login page captures your password.

What to do:

1. Do not click the link or button in the email.
2. Open the service yourself, using your usual bookmark or app or by typing the address you already know.
3. Log in there. If there really is a problem, you will see it.
4. If you are still unsure, contact the sender, such as your IT service desk, using contact details you already have or that are published on the official website. Never use the details given in the email.

The NCSC's advice is the same: contact the organisation directly using details from its official website, not from the message.

Report It Inside Your Organisation

Reporting helps your security team protect everyone else who received the same email.

1. Do not click, reply, open attachments or forward it to colleagues to ask "is this real?"
2. Report it using your organisation's process. This might be a "Report phishing" button in your email program or a dedicated security mailbox. Find out now which one your organisation uses.
3. Follow any instructions from your IT or security team. Some teams want you to delete the email after reporting it, and some pass reports on to the NCSC for you.

Report It to the NCSC

The NCSC runs the free Suspicious Email Reporting Service.

1. Forward the suspicious email to report@phishing.gov.uk.
2. The NCSC analyses the email and any websites it links to, and can work with hosting companies to remove malicious sites. As of July 2026, it had removed more than 450,000 scam URLs.
3. You will not hear back about the result, but the NCSC acts on every report it receives.

At work, always follow your organisation's process first.

If You Have Already Clicked

This happens to careful people too. Speed matters more than embarrassment.

1. Tell your IT or security team straight away, even if nothing seems to have happened.
2. If you typed in a password, change it from a device you trust, and follow your IT team's instructions.
3. If money was lost, the incident must also be reported to the police. In England, Wales and Northern Ireland that is Report Fraud (reportfraud.police.uk or 0300 123 2040). In Scotland, call Police Scotland on 101. At work, your organisation will usually do this.

Key Takeaways

• Watch for the NCSC's five pressure tactics: authority, urgency, emotion, scarcity and current events.
• Other common signs are a mismatched sender address, a generic greeting, an unexpected attachment and an unexpected request to log in.
• Never log in through an email link. Go to the service yourself, using a bookmark, an app or an address you already know.
• Report suspicious emails through your organisation's process. You can also forward them to report@phishing.gov.uk.
• If you clicked, tell IT immediately. Reporting quickly matters more than getting everything right.