A fraudulent invoice sent at 4.45pm on a Friday can look convincing enough to bypass even careful staff. It may use a supplier name your team recognises, refer to a real project and ask for a quick payment before the weekend. Knowing how to prevent email phishing means putting sensible checks around those pressured moments, not expecting people to spot every scam on sight.
For UK businesses, phishing is more than an inbox nuisance. A successful message can lead to stolen Microsoft 365 credentials, diverted payments, unauthorised access to customer information or ransomware. The financial and operational impact can be significant, particularly where a small team is already managing IT alongside its day job.
What email phishing looks like now
Phishing has moved well beyond badly written messages claiming you have won a prize. Criminals regularly impersonate Microsoft, banks, delivery firms, solicitors, suppliers and senior colleagues. They use copied logos, believable email signatures and language tailored to a business, department or individual.
The aim is usually one of three things: to make someone reveal a password, open a malicious attachment, or approve a payment or change to bank details. Some messages lead to a fake Microsoft 365 sign-in page. Others start a conversation, with the attacker posing as a director and requesting an urgent transfer. This is often called business email compromise.
A message can look legitimate while still being unsafe. That is why a prevention plan needs both alert employees and technical controls. One should support the other.
How to prevent email phishing before it reaches staff
The most effective place to stop a phishing email is before it lands in an employee’s inbox. Modern email filtering can assess sender reputation, message content, suspicious links and attachments, then quarantine high-risk messages. It will not catch everything, but it removes a large volume of routine threats and gives staff fewer risky decisions to make.
For businesses using Microsoft 365, the security settings should be configured to match the level of risk. This may include stronger anti-phishing policies, attachment scanning, safe-link protection and external sender warnings. The right configuration depends on how your organisation works. A company that receives invoices from many new suppliers, for example, may need a more carefully tuned approach than one with a small, fixed supplier base.
Multi-factor authentication is equally important. If an employee does enter a password on a fraudulent page, multi-factor authentication can prevent that stolen password from being enough to access the account. Use an authenticator app or security key where practical, rather than relying solely on text messages.
It is also worth reviewing who has administrator rights, who can create mailbox forwarding rules and which accounts can approve payments. Attackers often use a compromised mailbox to set up hidden forwarding, watch conversations and strike when an invoice or payment request is expected. Limiting access reduces the damage one compromised account can cause.
Give staff clear checks, not vague warnings
Telling people to “be careful” is unlikely to change behaviour. Staff need a short, repeatable process that works when they are busy. The most useful habit is to pause before acting on any unexpected request involving credentials, payment, sensitive information or attachments.
Encourage employees to check the full sender address, not just the display name. An email apparently from a trusted supplier might come from a similar-looking domain with one changed letter. They should also hover over links before selecting them, although this is not a guarantee of safety. A genuine-looking web address can still lead to a compromised site.
Payment requests need an additional control. A change to bank details, an urgent transfer or a request that breaks normal process should be verified through a known contact method. That means calling a number already held in company records, not the number in the email. This single step can prevent high-value fraud.
Training is most effective when it reflects the threats people actually see. Finance teams need examples of invoice fraud and supplier impersonation. HR teams may receive fake CVs or payroll requests. Senior staff are common targets for impersonation, while new starters may be more likely to trust a message that appears to come from IT.
Short, regular awareness sessions are generally more useful than a single annual presentation. Use realistic examples, explain the signs that matter and make it easy for staff to ask when they are unsure. The aim is not to create anxiety or blame. It is to make reporting the normal, responsible action.
Build a reporting route people will use
A suspicious email should be easy to report without the employee needing to decide whether it is definitely malicious. A dedicated reporting button in the email platform, or a clearly communicated IT support address, gives your team a consistent route to investigate messages.
Staff should know what happens next. They should report the email, avoid clicking links or opening attachments, and leave it in place until advised otherwise. If they have already entered credentials, they need to report it immediately. Prompt reporting allows IT to reset passwords, revoke active sessions, check mailbox rules and identify whether other users received the same message.
There is a trade-off here. Overly aggressive blocking can delay legitimate supplier emails, while a relaxed approach increases exposure. Reviewing quarantined messages and reported emails helps fine-tune controls over time. It also shows staff that reporting is worthwhile, rather than a task that disappears into a black hole.
Protect the business processes attackers exploit
Email security is not only an IT issue. Many phishing attacks succeed because a business process allows a single email to trigger a high-risk action. Finance, procurement and payroll procedures should include independent verification for changes to bank details and unusual payment instructions.
Consider separating responsibilities where possible. One person can request a supplier amendment, while another confirms it using a trusted contact record. For larger payments, a second approver should verify both the instruction and the destination account. These controls may feel slower than acting on an email alone, but they are far quicker than recovering from a diverted payment.
Sensitive documents also deserve attention. Avoid sharing passwords, bank details or personal information by email where a more secure approved system is available. If email must be used, confirm the recipient carefully and apply appropriate encryption and access controls. A misaddressed email is not phishing, but the same discipline helps prevent both problems.
What to do when someone clicks
Even well-trained people can be caught out, especially when attackers are using a real compromised supplier account. The priority is speed and a calm response. Staff should contact their IT support provider immediately, ideally by phone if their email account may be compromised.
The response should normally include resetting the password, revoking sign-in sessions, checking multi-factor authentication details, reviewing mailbox forwarding and inbox rules, and investigating recent sign-ins. If a payment has been made, contact the bank without delay and preserve the relevant emails and records for investigation.
Avoid treating the employee as the problem. If people fear blame, they will wait to report an error, and that delay gives an attacker more time. A supportive culture turns a potential incident into an opportunity to contain risk and improve controls.
Make phishing prevention part of managed IT
Phishing methods change constantly, so a one-off configuration review is not enough. Email protection, Microsoft 365 security, user awareness and payment controls should be reviewed together as part of ongoing cyber risk management. That joined-up approach helps identify gaps between technology and day-to-day working practices.
For businesses without a large in-house IT team, specialist support can provide the oversight needed to monitor alerts, manage security settings and respond quickly when something looks wrong. iData works with organisations to align managed IT support and cyber security controls with the way their people actually work, rather than applying a generic checklist.
The most useful test is practical: could a member of staff recognise an unusual request, report it quickly and continue working safely? When the answer is yes, phishing prevention becomes less about fear of the next email and more about dependable habits, clear processes and technology that supports the business.