Phishing is the most common cyber attack UK businesses face. This guide covers the warning signs, newer tricks such as AI written emails and QR codes, and exactly what to do if someone clicks.
Most cyber attacks on small businesses do not start with a clever hacker breaking through a firewall. They start with an email. Someone receives a message that looks like it comes from Microsoft, a supplier, a courier or even their own manager, clicks a link and enters their password, or opens an attachment they should not.
The UK Government's Cyber Security Breaches Survey 2025/26, published in April 2026, found that 43% of UK businesses identified a cyber breach or attack in the previous 12 months, and that phishing was by far the most common type, reported by 38% of businesses. The good news is that a team who know what to look for, and who feel comfortable reporting mistakes, can stop most phishing before it does any harm.
Phishing is when criminals send messages pretending to be someone you trust in order to trick you into doing something. That might be entering your password on a fake login page, opening a file that installs malware, paying a fake invoice or sharing sensitive information. Variants include spear phishing (aimed at a specific person), smishing (by text message) and vishing (by phone call).
No single sign proves an email is malicious, but the more of these you see, the more careful you should be.
The single most useful habit is to stop and ask: "Was I expecting this, and is it asking me to do something unusual?" If the answer is no and yes, check through another route before acting.
For years, poor spelling and grammar were the easiest giveaway. Generative AI tools have changed that. Criminals can now produce fluent, well formatted messages in any style, and tailor them using information from your website or social media. That means you should no longer rely on mistakes to spot a scam. Focus instead on what the email is asking you to do, and whether that request makes sense.
Some phishing emails now contain a QR code rather than a link, often claiming you need to scan it to set up multi factor authentication, view a document or confirm a payment. Scanning it with your phone takes you to a fake login page, and because your phone is usually outside the protection of your work email filtering, the attack can slip past controls designed to catch links. The same trick appears on printed letters, posters and parking signs. Treat a QR code exactly like a link: if you were not expecting it, do not scan it.
More advanced phishing kits can sit between you and the real Microsoft sign in page, passing your password and MFA code through and stealing the session that follows. The fake page can look identical to the real one. Checking the web address carefully, and using phishing resistant sign in methods such as passkeys, both help. Our guide to multi factor authentication explains the options.
Everyone can be caught out, including IT professionals. What matters is what happens next. If you think you have clicked a phishing link, opened a suspicious attachment or entered your password somewhere you should not have:
Your IT provider can then check for suspicious sign ins, look for new mailbox rules an attacker may have created, revoke active sessions and search for the same email in other mailboxes. If someone has paid a fake invoice, our article on business email compromise and invoice fraud covers the next steps.
Reporting takes seconds and helps protect other people as well as your own business.
Technology catches a lot of phishing before it reaches anyone, and email security filtering is essential. But some messages will always get through, so your people are an important last line of defence. Effective training is:
That last point matters most. A business where people feel able to say "I think I clicked something" within minutes is far safer than one where they keep quiet.
Cyber Fits helps businesses across Sunderland and the North East reduce the risk of phishing with email filtering, multi factor authentication and practical security awareness training for staff. If you would like to know how well protected your team is today, book a free IT review and we will take a look.
Forward it to the National Cyber Security Centre at report@phishing.gov.uk. Suspicious text messages can be forwarded free to 7726. At work, also report it to your IT support so they can protect your colleagues.
Tell your IT support straight away. If you entered a password, change it immediately from a trusted device. If money or bank details are involved, call your bank and report it to Report Fraud, or to Police Scotland on 101 if you are in Scotland.
Yes. They may have perfect spelling, but they still need you to do something, such as sign in, open a file or make a payment. Unexpected requests, urgency and changes to bank details remain the strongest warning signs.
Treat it like any other link. If you were not expecting it, do not scan it. QR codes are increasingly used in phishing because they move the attack onto your phone, outside the protection of your work email filtering.
Our guides are written by the team who support businesses across the North East every day. If anything here raises a question about your own setup, ask us.
Cyber security
Multi factor authentication is one of the most effective security steps a small business can take. Here is how the different methods compare and how to roll MFA out across Microsoft 365 without upsetting your team.
Productivity
AI assistants can save real time, but only if they are used with care. This guide covers data protection, what never to paste into an AI tool, tidying SharePoint permissions before Copilot, and a simple acceptable use policy.
Cyber security
Cyber Essentials is the UK Government backed scheme that shows your business has the basic security controls in place. Here is how it works, what it costs and how to prepare.
Book a free, no obligation IT review. We will look at your setup, tell you honestly what needs attention and give you a clear fixed monthly price.
