Handle a suspicious email calmly as a team

A suspicious message may arrive in the middle of a normal working day, looking like the next item in an existing task. A useful team response should therefore be simple enough to use without becoming an investigator. Focus on what the message asks you to do and how you can verify that request safely.

Notice the change in the task

An illustrative example is a familiar-looking supplier asking you to use different payment details urgently. The important signal is the unexpected change and pressure to act. Good spelling, a familiar logo or a display name does not settle whether the request is genuine.

Do not open an unexpected attachment or use the message's sign-in route while you are uncertain. Keep the business decision on hold rather than trying to prove the message safe by interacting with it.

Use an independent contact route

The NCSC recommends checking doubtful messages through official contact details rather than the links or numbers supplied in the message. For a known business relationship, use an established contact route already verified by your organisation.

Ask about the actual request without copying sensitive information into a new, unverified conversation. If the contact cannot confirm it, follow your internal procedure instead of letting urgency determine the answer. Payment changes should follow your organisation's established approval controls.

Make reporting straightforward

Agree how staff can report a doubtful message to the responsible colleague or IT support. Explain the information needed, such as the time received and whether any interaction occurred. Use the approved reporting method; casually forwarding a live attachment to many colleagues can spread the problem.

A person who clicked or entered information should report promptly and accurately. Blame makes it harder to understand what happened. Do not ask them to improvise technical cleanup or erase evidence; the responsible support team should guide the next steps.

Turn the incident into a practical improvement

After the immediate situation is handled, review which step was unclear. Perhaps the team did not know who could verify a request, or a substitute lacked the normal contact list. Improve that point and explain the change briefly.

The goal is not to identify every fraudulent message perfectly. It is to create a dependable pause and verification habit, with a clear route for help when a message does not fit the expected work.

Sources: National Cyber Security Centre: Spotting cyber attacks.