How to recognise a phishing email before sharing access

What does a phishing email try to make you do?

A phishing email tries to persuade you to take an action that benefits the sender, often by pretending to be a trusted organisation or person. The requested action might expose a password, approve an unexpected login or send money to the wrong account.

Website owners can receive convincing messages about domain expiry, suspended hosting or a supposed technical problem. These subjects feel important because an interruption could affect the business. That pressure can make a quick response seem sensible.

The NCSC guidance on spotting scams highlights pressure, claimed authority and emotional reactions as warning signs. It also explains that poor spelling is no longer a dependable way to distinguish scams.

Treat urgency as a reason to verify the request. It should not be a reason to skip the checks you would normally make.

How can you check the sender safely?

Check the sender’s actual address and then confirm the request independently. The display name alone is not enough: a message can show a supplier’s name while coming from another address.

Look for changes in the domain spelling, unfamiliar reply addresses and requests that do not fit your existing arrangements. These can raise suspicion, but a plausible address does not prove that an account has not been compromised.

Use a saved supplier contact or navigate to the provider’s website yourself. Sign in through your normal bookmarked route to check whether the same renewal or account notice appears there. Avoid searching for help using contact details provided by the suspicious message.

If a familiar colleague asks for something unusual, call them using their known number. Replying to the email may simply continue the conversation with whoever controls that inbox.

What should you do with links and attachments?

Leave unexpected links and attachments alone until you have verified their purpose. You can check an account notice without using the message’s sign-in button.

On a computer, hovering over a link can reveal its destination, but that is only one clue. Long addresses and redirects can be difficult to interpret. A padlock or HTTPS connection does not establish that the business behind a website is legitimate.

An unexpected QR code should receive the same caution as a clickable link. Moving the action onto your phone does not make it trustworthy. Likewise, a document that asks you to sign in before reading it deserves independent checking.

Do not open an attachment simply to investigate whether it is suspicious. Ask the supposed sender through a trusted channel what they sent and why, especially if you were not expecting a file.

How should staff handle requests for business access?

Staff should use an agreed approval process rather than sending credentials in response to an email. The process needs to identify who is requesting access, what task they will perform and who can approve it.

Where a website supports separate users, give a named person the permissions needed for the job. Avoid passing around a shared administrator login when individual access will work.

A short team routine can include:

• Confirm the request through an established contact.
• Check the account and permissions being requested.
• Use the organisation’s approved access-sharing method.
• Record when access should be reviewed or removed.

Make it easy for someone to pause a questionable request. A rushed colleague should not have to choose between risking the account and appearing unhelpful. Clear procedures help people make that decision calmly.

What if you have already shared information?

Act promptly using the provider’s official recovery and support routes. If a password was exposed, change it and check other accounts where it was reused. Tell the person responsible for the organisation’s technology so they can assess the wider issue.

Review unfamiliar sessions, users and recovery details where the service allows it. If money or financial information was involved, contact the relevant financial provider through its official route. Report the suspicious message using current NCSC guidance.

Preserve the message and a record of what happened rather than deleting the evidence immediately. Do not continue negotiating with the sender.

If you need practical help checking legitimate website permissions or removing unnecessary users, explore JigiWeb’s website support. Verify any support request first and agree the access needed for the specific job.