Could you spot a phishing email? A quick guide for everyday staff

Why is phishing harder to spot now?

Phishing is harder to spot now because the old advice about typos and bad grammar is increasingly outdated. AI now writes flawless, convincing phishing emails, and attackers often send from genuinely compromised accounts of people you know. So treat unexpected requests involving money, passwords or sensitive data as suspicious even when the email looks perfect — verify through a separate channel.

The golden rule

If an email asks you to do something involving money, credentials or sensitive information, and anything about it is unexpected — stop and verify using a known phone number, not the contact details in the email. Thirty seconds of verification beats a breach.

What should you do if you think you clicked?

Do not panic, and do not hide it — speed matters more than embarrassment. Disconnect the device from the network if you can, change your password from a different device, enable multi-factor authentication if it is not already on, and report it to your IT team immediately. A fast report often means the difference between a non-event and an incident. If you are a Key IT client, that means our helpdesk — and your systems are also covered by 24/7 SOC monitoring.

Why does training your team pay off?

Your staff are both your biggest risk and your strongest defence — the difference is awareness. Regular, low-key training and simulated phishing measurably lift how often people spot and report attacks. See how it works on our phishing simulation page.