Check a suspicious business email safely
A suspicious message may try to make you disclose information, sign in to a fake page or make an unauthorised payment. You do not need to prove exactly how the message was constructed before pausing. For an important unexpected request, verify it through a separate contact route you already know is genuine.
Before you start
- Do not open attachments, approve prompts or follow sign-in links while uncertain.
- Locate the supplier’s established contact details from your own records.
What to do
Identify the action being requested
Ask what the sender wants you to do: change bank details, share a code, move a domain or urgently sign in. Those consequences matter more than whether the message looks polished. A convincing email can use real project details or appear within a familiar conversation.
Verify through an independent route
Call the known contact number or open the supplier account using an established bookmark. Ask whether the specific request is genuine. Replying to the same message or calling a new number printed inside it does not provide the independent check you need.
Keep routine checks proportionate
Do not make every member of staff perform a technical investigation of email headers. Give people a clear rule for high-impact requests and a named person to ask. For example, changed payment details can require confirmation through the normal supplier contact before anyone authorises a transfer.
Report mistakes without delay
If someone has already clicked or supplied information, record what happened and contact the authorised account owner or IT support promptly. Avoid blame or hiding the incident. The right response depends on whether information was entered, an attachment ran or a payment was made.
What to check
- High-impact requests are verified using existing trusted details.
- Staff know where to report uncertainty or an accidental action.
- Any account or payment exposure receives an appropriate review.
Sources and further reading
Platform features can change. Check the provider’s current guidance before changing a live service.