For years, knowing how to spot phishing emails meant looking for typos, clumsy grammar and an odd-looking sender. That advice is out of date. AI writing tools have removed the sloppiness, and with it the easiest warning sign phishing used to give away.
The good news is that the real tells were never in the spelling. They are in what the message wants you to do. Here’s what the UK data says about the threat, what to look for instead, and what to do when one lands in your inbox.
How common is phishing for UK businesses?
Phishing is still the main way attackers get at UK businesses. In the government’s Cyber Security Breaches Survey 2025/2026 (published in April 2026 by DSIT with the Home Office; fieldwork ran from August to December 2025):
- 43% of UK businesses identified a cyber security breach or attack in the last 12 months. That’s around 612,000 businesses, including 46% of small businesses.
- 38% of businesses experienced phishing.
- Phishing was the most disruptive type of breach or attack for 69% of the businesses and charities that had one.
- Among businesses that had a breach or attack, 51% experienced only phishing, up from 45% the year before.
- Only 19% of businesses ran staff training or awareness-raising in the last 12 months, compared with 84% of large businesses.
The survey only counts incidents that organisations identified and were willing to report, so the real picture is likely worse.
Why AI changes the picture
In its assessment of the impact of AI on the cyber threat to 2027 (7 May 2025), the National Cyber Security Centre (NCSC) says criminals are “almost certainly” already using AI for tasks such as gaining access to systems through social engineering. It expects that, by 2027, this will “highly likely increase the volume and impact of cyber intrusions”, and that AI will lift the capability of novice cyber criminals from a low base.
In plain terms, a scam email can now be grammatically perfect and written in the language of your industry. The NCSC also notes that criminals use information about you that’s available online, such as what you post on social media, to make messages more convincing. The government survey doesn’t yet measure AI-written phishing specifically, so be cautious with any precise “AI phishing” statistic you see elsewhere. What changes is how you spot it.
How to spot phishing emails now: what to look for instead of typos
The NCSC’s advice on spotting scam messages focuses on what a message is trying to make you do, not how it’s written. Its tell-tale signs:
- Authority. The message pretends to be a bank, government department, solicitor or someone important.
- Urgency. You’re given a short time to respond, such as “within 24 hours” or “immediately”.
- Emotion. It tries to make you panic, fearful, hopeful or curious.
- Scarcity. An offer or opportunity seems limited, so you act before you think.
- Current events. It ties in with the news, a big event or a deadline such as tax reporting.
In a business, add these to the list:
- A request to change bank details, or to pay an invoice into a new account.
- An unexpected request from a director or manager that arrives outside the way they’d normally ask: a payment, gift cards, a password reset or a file.
- A link or attachment you weren’t expecting, even from a known contact whose account may have been taken over. The NCSC also warns that scanning a QR code in an email can lead to a scam site.
- Anything that skips the normal process or asks you to “keep this between us”.
If a message makes you suspicious, stop and don’t reply. Check with the sender using contact details you already trust, not the ones in the message.
Four phishing scams to expect
- The fake Microsoft 365 sign-in. “Your password expires today” or “a document has been shared with you”, with a link to a lookalike login page. Multi-factor authentication helps, and Passkeys go further, because a passkey can’t be handed over to a fake site.
- The supplier invoice or change of bank details. A message that looks like it’s from a regular supplier, asking you to pay a new account. Always confirm bank detail changes by phone, using a number you already hold.
- The “director” request. An urgent message apparently from the boss, asking you to make a payment, buy gift cards or share files, often sent when they’re known to be travelling or in meetings.
- The parcel or tax text. A text about a missed delivery or a refund, with a link. Phishing isn’t just email, and phone-based scams use the same urgency and authority tricks.
The NCSC’s figures show the reporting works at scale: more than 59.6 million reported scams, with 263,700 scams removed across 466,300 URLs (as of September 2026, NCSC phishing hub).
If you’ve clicked or shared details
- Tell IT straight away. Speed matters more than embarrassment, and the sooner it’s contained, the less damage it does.
- Change the password for any account you may have exposed from a device you trust, and check that your multi-factor authentication settings haven’t been altered.
- Don’t wait to see if anything happens. Attackers often use a stolen login within minutes.
- If money was lost or accounts were taken over, report it to Report Fraud at reportfraud.police.uk or on 0300 123 2040 (England, Wales and Northern Ireland), or call Police Scotland on 101. The NCSC says not to report a crime through its email service.
Why reporting matters as much as not clicking
A suspicious email that gets reported, even one nobody clicked, gives IT the chance to warn the rest of the business and block the sender before it reaches anyone else. Attackers often target several people in the same organisation, so one person’s report can protect everyone else.
The NCSC’s guidance for organisations is clear that blame backfires. “Blaming users for clicking on links doesn’t work,” it says, and “employees who are afraid for their jobs will not report mistakes.” It suggests measuring how many people report suspicious messages, not just how many click. To build that habit:
- Make reporting one simple action, such as a report button or a single forwarding address.
- Respond to every report the same way, and treat false alarms as proof the system is working.
- Give feedback, so people see their reports make a difference.
- When someone does click, focus on what to do next rather than who’s at fault.
- Treat phishing simulations as one measure among several. The NCSC says they aren’t a complete answer.
Build layers, not just vigilance
The NCSC is blunt that “some phishing attacks will always get through”, so you should plan for incidents. Its approach is four layers working together:
- Make it hard to reach your people: email filtering, plus anti-spoofing controls (DMARC, SPF and DKIM) so criminals can’t easily impersonate your domain.
- Help people spot and report: clear reporting and a second channel to verify important requests, such as a phone call for a change of bank details.
- Limit the damage: multi-factor authentication or Passkeys, a Password Manager, limited admin accounts and keeping your devices up to date, fully patched and monitored 24/7 – which our Managed IT Solutions can help you with.
- Respond quickly: monitoring and a plan you’ve practised, so you know who does what when something goes wrong.
The NCSC shows how this works with a case study of a financial firm that received 1,800 malicious emails. Filtering stopped 1,750. Of the 50 that reached inboxes, 14 were clicked, but up-to-date devices stopped 13 of them from running the malware. The one infection was detected and cleaned within hours. No single layer would have been enough. It’s also why our October series covers passkeys, password managers, phishing and patching: each one is a layer
Phishing FAQs
What is phishing?
Phishing is when criminals use scam emails, text messages or phone calls to trick people into clicking a link, handing over details or making a payment.
How can I tell if an email is a phishing email?
Look at what the message asks you to do rather than how it is written. Pressure to act quickly, someone claiming authority, a strong emotional hook, an unexpected link or attachment, or a request to change bank details are all warning signs. Typos are no longer a reliable clue, because AI tools can produce flawless writing. If in doubt, check with the sender using contact details you already trust.
How do I report a phishing email in the UK?
Forward it to the NCSC’s Suspicious Email Reporting Service at report@phishing.gov.uk. Forward suspicious texts to 7726. At work, tell your IT support first so colleagues can be warned. If you have lost money or been hacked, report it to Report Fraud at reportfraud.police.uk or on 0300 123 2040 (Police Scotland on 101 in Scotland).
What should I do if I clicked a phishing link at work?
Tell your IT support straight away, because speed matters more than embarrassment. Change the password for any account you may have exposed from a device you trust, and check that your multi-factor authentication settings haven’t been altered. If money was lost or accounts were taken over, report it to Report Fraud.
Does AI make phishing harder to spot?
The NCSC assesses that criminals are already using AI for social engineering and that, to 2027, this will highly likely increase the volume and impact of cyber intrusions. Because AI can remove the typos and clumsy wording that used to give phishing away, rely on what a message is asking you to do, not on how well it reads.
Can phishing be stopped completely?
No. The NCSC says some phishing attacks will always get through, so the aim is layers of defence: email filtering and anti-spoofing, multi-factor authentication or passkeys, regular patching, and a simple way for staff to report anything suspicious, plus a plan for when something does go wrong.
Need a hand with email security?
Prime Potential helps businesses put these layers in place: email filtering and anti-spoofing, multi-factor authentication and passkeys, patching, and a simple, blame-free way for staff to report anything suspicious. If you’re not sure how your business would cope with a convincing phishing email, Get in touch and we’ll talk it through. You can also read more about our Cyber Security Solutions
“Not sure where to start? Book a free IT audit, and we’ll look at your email security set-up as part of it.”]
Sources
Cyber Security Breaches Survey 2025/2026 (DSIT and Home Office, April 2026)
NCSC: Impact of AI on cyber threat from now to 2027 (7 May 2025)
NCSC: Phishing attacks, guidance for organisations
NCSC: Report a scam text message
NCSC: Phishing scams hub (reporting statistics, September 2026)
