Could you spot a phishing email? A quick guide for everyday staff

The newer, harder-to-spot signs

Be aware that the old advice about typos and bad grammar is increasingly outdated. AI now writes flawless, convincing phishing emails, and attackers often send from genuinely compromised accounts of people you know. So treat unexpected requests involving money, passwords or sensitive data as suspicious even when the email looks perfect — verify through a separate channel.

The golden rule

If an email asks you to do something involving money, credentials or sensitive information, and anything about it is unexpected — stop and verify using a known phone number, not the contact details in the email. Thirty seconds of verification beats a breach.

What to do if you think you clicked

Do not panic, and do not hide it — speed matters more than embarrassment. Disconnect the device from the network if you can, change your password from a different device, enable multi-factor authentication if it is not already on, and report it to your IT team immediately. A fast report often means the difference between a non-event and an incident. If you are a Key IT client, our SOC can act on it right away.

Why training your team pays off

Your staff are both your biggest risk and your strongest defence — the difference is awareness. Regular, low-key training and simulated phishing measurably lift how often people spot and report attacks. See how it works on our phishing simulation page.