By The KTech team · Published 29 October 2026
Phishing is a message that pretends to be from someone you trust, in order to get you to click, log in or pay. It is not new, but the messages have become tidier. The spelling mistakes that once gave them away are fading, and the pages they send you to look increasingly like the real thing.
Small businesses in Devon are not too small to be worth a criminal's time. In fact, a firm with a few staff, a bank account and a Microsoft 365 login is exactly the kind of target they like. Here are the lures we hear about most, the warning signs, and what your team should do when something looks off.
The lures that keep working
Fake invoices and payment requests. An email arrives with an invoice attached or linked, supposedly from a supplier you use or a firm you have never heard of. The attachment or link leads to a page that collects your details or installs something nasty.
Microsoft 365 and email log-in pages. 'Your mailbox is full', 'Your password expires today' or 'A document has been shared with you' all take you to a convincing sign-in page. Type your details in and the criminals now have your mailbox, and often the ability to email your customers as you.
Courier and parcel texts. A message about a missed delivery with a link to 'rearrange'. Holiday-let owners and shops that receive lots of genuine deliveries are particularly likely to click.
Messages that appear to come from the boss. A short, urgent email from someone who seems to be the owner or a manager, asking a colleague to buy gift cards or make a quick payment. The tone is rushed on purpose.
Shared-document notices. Genuine services like OneDrive and Google Drive send real notifications, which makes fake ones easy to hide among them.
Warning signs worth teaching your team
- Urgency or pressure: today, immediately, final notice, account suspended.
- An unexpected request, even from a name you know. A real colleague will not mind a quick call to check.
- A sender address that is slightly off, such as an extra letter or a different ending. Hover over the sender's name or the link, without clicking, to see where it really goes.
- Links to a sign-in page you did not ask for. If in doubt, go to the website yourself by typing the address, not by clicking.
- Attachments you were not expecting, particularly zip files, or documents asking you to 'enable content'.
- Requests to change bank details, or to keep something confidential from colleagues.
What staff should do: report, do not click
The most helpful habit is a simple one: if something feels odd, stop and tell someone. Make sure everyone knows who that someone is, and that nobody will be told off for raising a false alarm. The staff member who clicks and says nothing is a bigger problem than the one who reports ten harmless emails.
If you do click or type a password, say so straight away. Speed makes a big difference, because passwords can be changed and sessions ended before the damage spreads. Our page on what to do if you think you have been hacked is at hacked help.
For suspicious emails, forward them to the National Cyber Security Centre's reporting address, report@phishing.gov.uk, and for texts forward them to 7726. If you have lost money or been hacked, report it to Report Fraud, the national reporting service. The NCSC also has a good guide to dealing with phishing.
Make the basics do some of the work
Training helps, but you should not rely on people alone. Turn on multi-factor authentication for email and Microsoft 365, so a stolen password is not enough on its own. Keep software and browsers updated. Use the spam and phishing filters already included in your email service, and review them occasionally.
If your business runs on Microsoft 365, it is well worth having someone check the security settings are sensible. Our Microsoft 365 help page explains how we can support that.
Keep an eye on what is happening locally, too. Our overview of cyber threats in the South Hams is written for homes and businesses in this area, and our cyber security news section picks out stories that matter to small firms.
A local note
Criminals use the same templates across the country, but they borrow local names where they can: a nearby supplier, a well-known bank, a utility. That is why a general sense of caution works better than memorising examples. If you run a business in Dartmouth, Salcombe or Totnes, the advice is the same as in the rest of Devon: pause, check and report. We cover IT support in Totnes and the rest of the South Hams.
If someone has already clicked
It happens to careful people. What matters is what you do in the next few minutes. Tell whoever looks after your IT, or the business owner, straight away. If you typed a password into a page that looked wrong, change it from a device you trust, and change it anywhere else you have used the same one.
Check the mailbox for anything unfamiliar, such as sent messages you did not write or new rules that forward your mail. If you paid something or shared card or bank details, ring your bank without delay. We do not give step-by-step repair instructions in articles like this, because every case is a little different, but we are happy to talk it through.
Afterwards, it is worth looking at what let the message through. A short review of your filters and sign-in settings often closes the gap for next time, and it is much better done calmly than in a rush.