An email says your account will close today. Another says a parcel needs a small payment. A third looks like an invoice from someone you know.
The difficult part is that a real reminder and a scam can ask for similar things. You do not need to decide by appearance alone. The most useful question is: can I check this request through a route I already trust?
This guide gives you seven checks to use before responding. The examples are fictional; they are not reports of a new incident on 15 October 2026.
1. Identify the action it wants
Before examining logos or spelling, finish this sentence: “This message wants me to…” Is the answer send money, reveal a password, approve a login, open a document or install something?
That gives you a specific request to verify. A message can contain accurate background information and still direct you towards an unsafe action. The NCSC’s scam-spotting guide describes how impersonation and pressure can influence a recipient’s decision.
2. Notice the pressure
Treat a countdown as a reason to pause. A fictional message saying “Your mailbox closes in 20 minutes” creates a deadline before you have checked whether the problem exists.
Open your usual account app or saved bookmark and look for the same warning there. If nothing appears, contact the provider through its established support channel. Do not let the email choose both the problem and the only way to fix it.
3. Check the sender beyond the display name
“Accounts Team” is a label, not proof of identity. Expand the sender details and compare them with previous, independently verified correspondence. Unexpected changes deserve a check, especially when payment instructions have also changed.
A plausible address is only one clue. Avoid turning this into a single pass-or-fail test: your aim is to establish whether the request itself is genuine.
4. Use your own route to the service
You usually do not need to open a suspicious link to investigate an account warning. Use the official app, a bookmark you already use, or an address you know independently.
For example, if a fictional delivery email asks you to pay a fee, find the order in the retailer’s app first. Check the tracking details from there. This keeps the investigation separate from the message you are questioning.
QR codes inside unexpected emails deserve the same caution. Moving the request onto your phone does not establish who sent it. The NCSC specifically warns about QR codes used in phishing messages.
5. Verify payment changes separately
Imagine a supplier sends an invoice with a note: “We have changed banks. Please use these details.” The invoice could look completely familiar. What needs checking is the change.
Call the supplier using a number already held in your records. Ask them to confirm the request through your normal process. Do not use a replacement number supplied in that same message. For a team, write down who verifies changes and who approves payments so that the decision does not depend on one hurried person.
6. Treat requests for codes or software as a separate decision
An email conversation should not rush you into handing over a sign-in code, approving an unexpected login prompt or installing remote-access software.
If you did not start a support session, stop and contact the service yourself. If it concerns a work account, send it to your IT or security team through their normal reporting route. A request to “keep this between us” is another reason to involve the appropriate person.
7. Choose a clear next step
The point of these checks is to decide what to do, rather than spend half an hour debating whether an email looks convincing.
| Situation | Practical next step |
|---|---|
| The request seems unusual, but might be genuine | Verify it through an independent contact method. |
| You have not interacted and suspect a scam | Report the message and avoid its links or attachments. |
| You entered a password | Open the genuine service and secure the affected account. |
| It involves work systems | Tell your IT or security team promptly. |
| You supplied bank details or sent money | Contact your bank using its official app or a trusted number. |
Where to report a suspicious email in the UK
Forward suspicious emails to report@phishing.gov.uk, the NCSC’s reporting service. You can report uncertainty; you do not need to prove that a message is malicious. Reporting an email is different from reporting a crime or asking your bank to address a payment.
See the NCSC’s email reporting page for the reporting process and current links for victims of fraud. Use your organisation’s reporting route too if the message reached your work inbox.
Already shared something? Act on what was exposed
If you shared a password, change it on the genuine service and on any other account where you reused it. If you supplied banking information, contact your bank. For a work device or account, involve your IT team. The NCSC’s steps after sharing sensitive information distinguish these situations.
For an account takeover, recovery can involve more than changing the password. Review email forwarding rules, sign out other sessions and check security settings. Follow the provider’s recovery process and the NCSC hacked-account guide.
Practise before the next urgent message
Try Cyvack’s free phishing awareness quiz. Read the explanations even when you answer correctly: a useful habit is knowing why you paused, not simply recognising an example you have seen before.
A good-looking email can still deserve a check. Give yourself permission to pause, verify the request independently and ask for help when needed.
Sources: NCSC guidance linked throughout, checked on 15 October 2026. Cyvack’s scenarios and seven-check structure are illustrative educational material. This article does not analyse a submitted email or certify a message as safe.
