Five phishing red flags every employee should know

Published 2026-06-11 by Woodruff Training

Nine times out of ten, an attack on a small business does not start with clever hacking. It starts with an email that looks normal enough for a busy person to click without thinking. The good news is that the same handful of warning signs show up again and again, and once your team knows them, most of these emails get spotted and deleted.

1. A sense of urgency

"Your account will be closed in 24 hours." "Pay this invoice today to avoid a late fee." Attackers push you to act before you think. A genuine supplier or bank is almost never that dramatic. If an email is rushing you, slow down.

2. The address is almost right

The display name might say your bank, but the real address behind it is something like security@bank-alerts-uk.com. On a phone this is easy to miss. Teach staff to press and hold (or hover on a desktop) to see the true sender before trusting anything.

3. It asks you to change how you get paid

Any email asking to update bank details, redirect a payment, or "confirm" account information deserves a second channel. Phone the supplier on a number you already have (never the one in the email) and confirm before moving a penny. This one habit stops most invoice fraud.

4. Unexpected attachments or links

An invoice you were not expecting. A "delivery" you did not order. A shared document from someone you barely know. When in doubt, don't open it. Check with the person first.

5. It just feels slightly off

Odd phrasing, a greeting that isn't quite how a colleague speaks, a logo that looks stretched. Trust that instinct. It is usually right, and it costs nothing to double-check.

Make it a habit, not a one-off

Reading a list once does not change behaviour. Short, regular reminders keep these signs fresh, which is exactly what our awareness training is built to do.

We have put these five flags on a one-page poster you can print and pin up in the office. There is a blank line at the bottom to write in whoever your staff should report to, which is the detail people forget when it matters.

Want a plain-English session for your team? Get in touch.