Suspicious Email: Pause, Verify and Report

A simple sequence for suspicious email

An unexpected message may ask you to pay, sign in or share information. An urgent tone does not establish that the request is legitimate. Use the original RDE infographic below as a reminder to pause, verify and report.

Complete text equivalent

1. Pause. Do not use the message’s links or attachments while you are unsure. Do not reply with passwords or verification codes.
2. Verify independently. Open a known service yourself or contact the organisation using details you already trust. Do not rely on a phone number supplied only in the suspicious message.
3. Report. The NCSC advises forwarding suspicious emails to report@phishing.gov.uk. At work, also follow your organisation’s reporting process.

If you have already responded

Follow the current NCSC guidance linked below and contact your organisation’s IT or security team if work information or a work account is involved. If you entered banking details or authorised a payment, contact your bank promptly through a trusted channel.

Practise the sequence

Consider this fictional message: “Your invoice is overdue. Open the attached payment form immediately.” Write down how you would verify the request without opening the attachment. Identify your workplace reporting route before you need it.

The infographic is a reminder, not a guarantee that you can identify every malicious message. Its advice is based on the linked NCSC guidance, checked on 7 October 2026. You may share the original RDE visual for awareness training with author credit.