As of September 2026, the public has reported more than 59.6 million suspicious emails to the National Cyber Security Centre’s reporting service, leading to 263,700 scams and 466,300 malicious websites being taken down. That volume alone tells you something: phishing isn’t a rare event aimed at the unlucky, it’s background noise that every business with an email address is sitting in.
What it actually looks like has changed more than most people realise. The badly spelled email from a prince with a fortune to share is still out there, but it’s not what catches experienced staff out any more. The ones that work now are built to look exactly like something you were already expecting.
| Old style phishing | Modern phishing | |
|---|---|---|
| Writing | Poor spelling and grammar, obvious tell | Polished, matches the real sender’s tone |
| Timing | Sent at random | Timed to match a real invoice, delivery or deadline |
| Branding | Generic or mismatched logos | Pixel accurate copies of real login pages and emails |
| Target | Mass blast to thousands | Often aimed at one person with a specific role |
| Giveaway | Obvious fake link or address | Address looks right at a glance, fails only on close inspection |
It’s also common rather than occasional. Phishing affects 38% of UK businesses, according to the same Cyber Security Breaches Survey covered in the previous post on this blog. The three patterns below are the ones that actually land in a business inbox most often.
The invoice that looks exactly right
This is business email compromise, and it’s one of the most expensive forms of phishing because it doesn’t ask you to click anything suspicious. It asks you to do something ordinary: pay an invoice you were already expecting, to an account that’s changed.
It usually starts with a supplier’s email account being compromised, or a lookalike domain that’s one letter off the real one. Partway through a genuine transaction, a message arrives saying the bank details have changed, often referencing the actual invoice number and the actual amount, because the attacker has been reading the real conversation. Nothing about the email looks wrong because large parts of it are real.
The only way this gets caught reliably is by never changing payment details on the strength of an email alone. A phone call to a number you already had on file, not one in the email, closes this off completely.
Where the attacker’s own access comes from varies. Sometimes it’s a password reused from a different, already breached site. Sometimes it’s a lookalike domain, registered with a hyphen added or a single letter swapped, close enough that it passes a quick glance at the sender’s address. Either way, by the time the fake invoice message arrives, the groundwork was laid days or weeks earlier.
The login page that looks exactly like Microsoft 365
Credential phishing doesn’t try to install anything on your computer. It tries to get you to type your password into a page that looks identical to the Microsoft 365 or Google Workspace login screen you use every day, hosted on a domain that’s close enough not to register as wrong on a quick glance.
Once that password is typed in, the attacker has it, and from there they can read your email, see who you’re already talking to, and use that access to send the next phishing email from inside your own account, to people who trust it completely. This is often how one compromised account turns into several.
Multi factor authentication is the single most effective block here. Even with the password, a second step the attacker doesn’t have stops the account being usable. It’s also worth checking where the link in the original message actually points before clicking anything, since most email clients show the real destination on hover or long press, and a mismatch between what the link says and where it leads is usually the clearest sign something’s wrong.
The delivery text that looks exactly like a courier
Smishing, phishing sent by text rather than email, leans on something almost everyone is doing most weeks: waiting for a parcel. A text arrives saying a delivery couldn’t be completed, with a link to confirm details or pay a small redelivery fee, from a sender name that displays as a real courier brand.
The link usually leads to a convincing payment page asking for card details, sometimes followed by a call from someone claiming to be from your bank about “suspicious activity” on the card you just used, because the two scams are often run together. It works on business mobiles as well as personal ones, and it works regardless of job title, which is part of why it spreads as fast as it does.
Part of what makes this one convincing is sender ID spoofing: a text can be sent with a display name set to match a real courier’s name, so it appears in the same message thread as genuine delivery updates you’ve had before, rather than arriving from an unfamiliar number. The content is faked. The thread it lands in often isn’t.
Why these are getting harder to spot
None of this is static. The National Cyber Security Centre’s own assessment of AI’s effect on the UK threat picture, published in early 2024 and looking ahead to 2025, concluded that generative AI and large language models would make it harder for everyone, “regardless of their level of cybersecurity understanding,” to judge whether a message is genuine. That assessment is now playing out in ordinary inboxes. The spelling mistakes and clumsy phrasing that used to be the easiest tell are disappearing, because the tools that write convincing English are now freely available to criminals as well as everyone else.
That doesn’t mean there’s nothing to look for. It means the things worth checking have shifted from how an email reads to what it’s actually asking you to do: pay somewhere different, log in somewhere unfamiliar, or act before you’d normally have time to think.
What actually stops it working
A small number of habits account for most of the protection here, and none of them depend on spotting bad writing.
Verify any change to payment details by phone, using a number you already had, not one supplied in the message making the request. Turn on multi factor authentication for email and any cloud login, so a stolen password alone isn’t enough to get in. Treat an unexpected delivery text the same way you’d treat an unexpected phone call asking for your card details, by going to the courier’s own app or website directly rather than following the link. And report anything that looks like phishing to NCSC’s Suspicious Email Reporting Service by forwarding it to report@phishing.gov.uk, which is also how the 263,700 takedowns mentioned above actually happen.
None of this requires everyone in a business to become a security expert. It requires the few habits above to be the normal way of doing things, not an exception people remember only after something’s gone wrong.
Frequently asked questions
Is phishing still mostly sent by email?
Email remains the largest single channel, but text messages and, increasingly, messages through WhatsApp and other apps are catching up, partly because people are more used to being cautious with email than with a text that looks like it’s from a courier or a bank.
How can staff get better at spotting these without becoming paranoid about every message?
The useful habit isn’t suspicion of everything, it’s a pause before acting on anything that asks for payment details, login credentials or urgent action, and a willingness to verify through a separate channel when something’s being asked that wasn’t expected.
What should someone do if they’ve already clicked a link or entered details?
Change the password immediately from a different, uncompromised device, turn on multi factor authentication if it wasn’t already on, and tell whoever manages your IT straight away rather than waiting to see if anything happens. The earlier a compromised account is dealt with, the less an attacker gets to do with it.
Does reporting a suspicious email to the NCSC actually do anything?
Yes, in a measurable way. The 263,700 scam takedowns mentioned earlier didn’t happen on their own, they came from the volume of reports the public and businesses sent in through the Suspicious Email Reporting Service, each one adding to the evidence used to get malicious sites removed. Forwarding one phishing email takes seconds and genuinely contributes to that total.
127 Solutions runs a free 20 minute IT audit for businesses across Cheshire, Wirral, Chester and Liverpool, including checking whether multi factor authentication is actually switched on everywhere it should be, which is one of the most common gaps we find when we look properly rather than taking someone’s word for it. Book yours here.
