2. Impersonation of colleagues, suppliers and support teams

An email appears to come from a director asking for an urgent payment. A supplier announces new bank details. Someone claiming to be your IT provider calls and asks for access to your computer.

Criminals exploit familiar names and relationships to make these requests convincing. They may use lookalike email addresses or compromised accounts, so a message can even arrive from a genuine account.

For Finance teams, supplier bank-detail changes deserve particular attention. A genuine invoice can become part of a scam if the payment is redirected to an account controlled by criminals.

What to do:

• Confirm changes to bank details using a trusted phone number already held on file.
• Check unusual payment instructions directly with the colleague concerned.
• Verify unexpected support calls with your IT provider before installing software or allowing remote access.
• Do not disclose passwords or security codes to an unexpected caller.
• Follow normal approval processes, even when a request appears to come from someone senior.

Urgency, secrecy or pressure to bypass checks should prompt an independent conversation.

3. Fake Microsoft 365 sign-in and document requests

A message says a colleague has shared a document. To open it, you are asked to visit a Microsoft sign-in page and enter a code supplied in the message.

The page may be genuine, but the request can still be fraudulent. In an attack known as “device-code phishing”, criminals trick someone into completing a legitimate sign-in process that gives the attacker access to their account.

This is why checking the website address alone is not enough. You also need to understand what you are being asked to authorise.

What to do:

• Confirm unexpected document requests with the sender through a known contact method.
• Do not enter a sign-in code supplied in an unsolicited message without verifying the request.
• Read authentication prompts carefully and question anything you did not initiate.
• Ask your IT team if the sign-in process differs from how you normally access work documents.

4. Fake verification checks and error-fixing pages

A website asks you to prove you are human or fix a browser problem. Instead of a normal verification check, it tells you to copy and run a command on your computer.

These attacks, often called “ClickFix”, persuade people to install malicious software while believing they are resolving a technical issue.

The page may look familiar or professional. The warning sign is the instruction to run a command outside the browser.

What to do:

• Do not follow website instructions to paste commands into your computer’s Run window, PowerShell or Terminal.
• Close the page and ask your IT team for help.
• Do not install software from an unexpected prompt to repair an alleged problem.
• If you have already followed the instructions, contact IT promptly and explain what happened.

Make checking part of everyday work

Give staff permission to question unusual requests, including those apparently sent by managers or trusted suppliers.

Before paying, signing in, sharing information or granting access, pause and verify the request through a contact method you already trust. A familiar name, convincing message or genuine login page should not be your only check.

Training works best alongside practical controls, including payment approvals, appropriate account permissions, security updates and protection for business devices.

What if someone has already responded?

If payment or card details are involved, contact your bank or card provider immediately using its official contact details.

If business credentials have been entered, a sign-in approved, software installed or remote access granted, contact your IT team or support provider promptly. Keep the message and relevant details to help them investigate.

Forward suspicious emails to report@phishing.gov.uk and suspicious texts to 7726.

Encourage people to report concerns quickly and without fear of blame. Early reporting gives your business a better chance of limiting the impact.

Speak to Beaming about practical protection for your business accounts, devices and network. Let’s talk