Phishing Investigation and Fake Message Help

Why phishing deserves careful handling

A phishing message may look like an annoying fake email, but it can also be the first visible sign of a wider compromise. Attackers may use fake parcel messages, bank alerts, Microsoft 365 prompts, QR codes, social media messages or supplier emails to steal credentials, bypass multi-factor prompts, install remote access tools or redirect payments.

The important question is not only “was this message fake?” but also “did anyone click, enter details, approve a prompt, download a file, scan a QR code or forward the message to others?” That difference changes the response.

Signs that specialist help may be useful

• Someone entered a password, one-time code or banking details.
• A mailbox begins sending strange messages or replies.
• Invoices, supplier details or payment instructions changed.
• New login alerts appear from unfamiliar locations or devices.
• A fake page copied your business brand or customer portal.
• Staff are unsure how far the message spread internally.

Evidence to preserve

Keep the original email or message, full headers if available, screenshots of the link destination, the sender address, phone number, URL, attachments, approximate time clicked and the device used. Do not delete the message from all systems until a copy has been preserved.

What a specialist may check

A consultation may review email headers, suspicious domains, mailbox rules, login records, account recovery settings, forwarding rules, affected users and whether the incident links to malware, data exposure or business email compromise.

Do not re-enter credentials into a suspicious page to “test it”. Use official websites or apps typed directly into the browser, and change passwords from a trusted device.

Related help