Phishing: examine the request behind the message

A credible layout is not authentication

Attackers can replicate a bank’s colours or a supplier’s email style. Some messages also appear inside compromised genuine conversations.

Look beyond visual clues to the login location, expected procedure and independent ways to contact the organisation.

Avoid the trap of a direct link

If a notification demands a password, go to the known service yourself. Check the site address carefully, and do not submit temporary codes to an unsolicited correspondent.

Report suspicious mail through the relevant provider facilities and avoid forwarding sensitive attachments unnecessarily.

If credentials have been exposed

Change them from the legitimate site, review active sessions and secure related accounts where reused credentials could be at risk.

Document the message and circumstances, but prioritise access recovery rather than trying to trace the sender.

Explore relevant guidance