A guide to spotting and dealing with phishing emails

---

Phishing emails remain one of the most common cyber security threats facing organisations today. Attackers often impersonate trusted organisations, colleagues, or service providers in an attempt to trick recipients into revealing sensitive information or clicking malicious links.

Understanding how to recognise phishing emails is an important part of protecting both personal and business data.

If you receive a suspicious email, the first rule is simple: do not click any links or attachments until you are certain the sender is genuine.

I've Received a Suspicious Email — What Should I Do?

If you have received an email that seems unusual or unexpected, pause before taking any action.

If you haven't clicked any links or downloaded attachments, that’s a good start. Until you're confident the sender is legitimate, you should avoid clicking links, replying to the email, or providing any personal information.

The next step is to determine whether the message is genuine or part of a phishing attempt.

Common Signs of Phishing Emails

Many phishing emails share common warning signs. Looking out for these indicators can help you identify fraudulent messages quickly.

Poor grammar or spelling

Phishing emails are often created quickly and may contain spelling mistakes, awkward grammar or unusual wording.

Low quality design or formatting

Does the email look like something you would normally expect from the organisation it claims to be from? Poor layout or unusual branding can be a warning sign.

Generic greetings

Messages that begin with phrases such as "Dear Customer", "Valued Client" or "Friend" may indicate that the sender does not actually know who you are.

Urgent or threatening language

Phishing emails often try to create panic or urgency. Be cautious of phrases such as:

• “Respond within 24 hours”

• “Your account will be suspended”

• “Immediate action required”

This pressure is designed to make you act without thinking.

Check the Sender Carefully

Look closely at the sender's email address. Attackers often attempt to mimic legitimate organisations by using addresses that appear similar but contain small differences.

For example; security@paypa1.com.

At first glance this may appear genuine, but closer inspection often reveals subtle differences.

If an email claims to be from your bank or another trusted organisation, it is always best to verify the request through another channel.

Verify the Information Independently

If an email asks you to provide personal information or click a link, take a moment to verify the request.

You can do this by:

• contacting the organisation directly using their official website

  
  

• calling their customer service line

  
  

• searching online for the wording used in the email to see if it has been reported as a scam

Remember that legitimate organisations will rarely ask you to provide sensitive information via email.

What To Do If You Suspect a Phishing Email

If you believe an email may be fraudulent:

• Do not click links or download attachments

• Do not reply to the sender

• Mark the email as Spam or Junk in your email system

• Report the message to your IT department (if applicable)

In the UK, suspicious emails, phone calls or text messages can also be reported to Action Fraud.

Why Phishing Awareness Matters

Many cyber security incidents occur not because of sophisticated hacking techniques, but because attackers successfully trick users into giving away information.

Developing awareness of phishing risks helps individuals and organisations reduce the likelihood of data breaches, financial loss and reputational damage.

Even simple precautions can significantly improve your security posture.

If you would like to strengthen your organisation’s information security controls or explore ISO 27001 information security management, Keystone Standards can help.

Discuss your requirements with our Lead Implementer Scott Naisbett.

Speak to an ISO Consultant