Spotted an email that doesn’t look quite right? It could be a phishing attack. It’s very important to stay alert.
Phishing is a type of cybercrime where fraudsters try to deceive people into handing over sensitive details, such as login credentials, bank information or personal data. They often do this by pretending to be a trusted organisation or authority figure, making their messages appear genuine.
If you believe you’ve been scammed through a phishing email, you can seek legal help.
Here at CEL Solicitors, we provide scam and fraud recovery support – helping you seek the legal support you deserve.
In this guide, we’ll cover how to spot a phishing email, how to prevent phishing scams from happening and what to do if you have fallen victim to a phishing attack and you’re looking for legal support.
Tips for Spotting Phishing Emails
Being able to recognise a phishing email is one of the best ways to protect yourself.
These scams are often designed to look convincing, but there are several warning signs you can look out for:
Language & Appearance
The scammer’s language and the way they present their communications can be a big tell to spot a phishing email. Look out for:
Generic greetings
Many phishing emails start with “Dear Customer” instead of your actual name. That implies they are sending out a generic email to multiple email addresses simultaneously, hoping to trick someone into revealing their details. A legitimate company will likely already know your name and be able to personalise their communication.
“Too good to be true”
Offers of prizes, discounts or deals that sound unrealistic are often bait for phishing scams – so, while they may seem appealing, don’t trust anything that seems too good to be true.
Urgent language
Phrases like “your account will be closed” or “immediate action required” are designed to pressure you into responding quickly, causing you to act rashly and give away valuable, sensitive information.
Inconsistent tone
Similarly, an email from a trusted organisation that suddenly uses casual, overly friendly or aggressive language is often a fake. A legitimate email from a real company would use language that’s consistent with their previous communications.
Suspicious sender address
This is one of the best ways to spot a scam email – check the email address carefully. Even small variations from the official domain can indicate it’s actually from a scammer. You can check by clicking on the sender address at the top of the email.
Poor presentation
Look out for spelling mistakes, awkward, clunky grammar or strange formatting that wouldn’t normally appear in a professional email. All of these are signs of a phishing attack.
Mismatched branding
Some scammers can be clever and incorporate brand visuals in their messaging. Check for logos, colours or layouts that don’t look quite right compared to genuine company emails.
Links & attachments
If you spot a suspicious email that has a link or attachment in it, firstly, do not click on or download it. Here are the best ways to spot scam emails from included links or attachments:
Hover-over links
If you are on a laptop or a desktop computer, hover over the links so you can preview the link address without clicking on it. When you hover your mouse over a link, the web address may not match the text shown (e.g. it says www.bank.co.uk, but the real link points elsewhere).
Suspicious links or attachments
Be mindful to never click on unfamiliar links or download unexpected attachments. They may lead to fake websites designed to steal your details or install malicious software.
Attachments with unusual file types:
Files ending in .exe, .zip, or .scr are especially risky, as they can hide malicious malware that’s designed to infiltrate and harm your device, gaining unauthorised access to harvest your personal data.
Timing
You can tell a lot about an email from the time it’s sent and the context. Here are the best ways to spot a scam email based on timing:
Time-sensitive offers sent at odd hours
Emails sent at unusual times (e.g. 3am) or clearly in other time zones around the world can be suspicious. Equally, those with immediate deadlines can be a big tell, as they’re trying to push you to act rashly and reveal sensitive information.
Out-of-place timing
The context of timing is important, too. For example, receiving a “tax refund” email from HMRC outside of the usual tax deadlines, or a “parcel delivery” notification when you’re not expecting one, is a red flag.
Unexpected contact
Be cautious of emails that are sent out of the blue, especially those claiming to be from banks, government departments or well-known companies.
Requests
And, of course, requests to reveal personal information, especially if done so in a threatening or urgent way, are a big tell of a phishing attack.
Requests for personal information
Keep in mind that legitimate organisations will never ask you to confirm passwords, bank details or login credentials via email, so be sure to never reply to emails revealing sensitive information.
Read receipts
Some phishing emails can request a read receipt. Accepting this can confirm to the scammer that your email account is active, making you a bigger target. They’re then likely to get in touch with you again with more urgent messages.
Requests for secrecy
Some phishing scams instruct you not to tell anyone, and make you act without asking for help. This, again, is a red flag and should be reported immediately.
In short, trust your instincts. If something feels off, it probably is. It’s always safer to delete the email and, if in doubt, contact the organisation directly using trusted details.
Keeping Yourself Safe Against Phishing Attacks
Now that you know the signs of a phishing email, you can take steps to reduce your risk of falling victim.
Some good email security habits include:
- Use strong, unique passwords and change them regularly.
- Limiting personal info online – don’t overshare sensitive details on social media.
- Enabling two-factor authentication (2FA) – ideally with an app, rather than SMS.
- Keeping devices and software updated to avoid vulnerabilities.
- Being cautious with links and attachments – never click or download from unknown sources.
- Verifying requests directly with the organisation before responding using trusted contact details.
- Checking website security – look for “https://” and a padlock to ensure a website’s security.
- Being careful on public Wi-Fi – especially when signing into sites with personal information, such as mobile banking apps.
- Setting up account alerts for unusual activity.
- Staying informed about common phishing tactics and new scams.
Find more details in our dedicated guide on how to prevent phishing attacks.
What Are the Laws on Phishing Emails in the UK?
In the UK, phishing emails are a criminal offence and are treated very seriously under the Fraud Act 2006. In some cases, phishing emails may also breach the Computer Misuse Act 1990, particularly when malicious software is used to capture data, or the Data Protection Act 2018, where personal information is unlawfully harvested.
Penalties for those convicted of phishing emails can be severe, including fines and imprisonment.
However, while the law provides robust protections, the process of taking action and recovering financial losses can often be complex. This is why many victims turn to specialist fraud and scam recovery solicitors, who can guide them through the legal system and maximise their chances of securing redress.
Reporting Phishing Scams
If you come across a suspicious email – like one that appears to come from Microsoft or another service – you should report it directly to the provider that manages the account. Most major platforms have a dedicated process for flagging phishing attempts.
You can also notify the UK government about scams and phishing attempts. GOV.UK offers clear instructions for forwarding suspicious emails or text messages, as well as information about how to report misleading advertisements or online fraud.
Taking the time to report phishing not only helps authorities track and investigate scammers, but it can also prevent others from becoming victims by flagging dangerous email addresses.
I’ve Been Successfully Phished & Lost Money – What Do I Do?
If you’ve inadvertently fallen victim to a phishing email attack, you can seek legal support to help you retrieve your money.
Before you make your claim, make sure you follow these steps:
1. Document the email(s)
Make a record of all relevant details of the phishing attack while they’re still fresh.
Take screenshots of the message, note the sender’s email address, the subject line, any links or attachments, and any personal information you may have entered or shared.
Recording these details can help support any investigations or claims you may need to make later.
2. Report the phishing email
Before taking further action, officially report the phishing email to:
- Your email provider: Most platforms, like Microsoft or Gmail, have a reporting process for phishing messages.
- Your bank or payment provider: If the phishing email involved financial information, alert your bank immediately so they can monitor or block any suspicious transactions.
- The authorities: In England and Wales, contact Action Fraud, the UK’s national centre for reporting cybercrime and fraud. After reporting, you will receive a police crime reference number, which may be needed for any legal or recovery processes.
3. Secure your accounts
If the phishing email led to any personal information being shared, take steps to secure your accounts immediately.
This could include changing passwords and usernames, enabling two-factor authentication and alerting your bank or phone provider if any financial details were exposed.
Acting quickly can help limit the potential damage of the attack, while also preventing further attacks on you or others.
Making a Claim Against a Phishing Email Attack
Once you’ve gathered evidence from the phishing email and secured your accounts, you’re ready to seek legal support.
Legal action following a phishing email attack can take two main forms:
- Civil action: This refers to filing a claim against the scammer to recover any financial losses by presenting your case in a civil court, which could result in a financial settlement if the case is successful.
- Criminal action: In some more extreme cases of reported phishing, the authorities may pursue criminal charges against the scammer. While you wouldn’t receive direct compensation, this helps prevent the scammer from targeting others.
It’s important to note that phishing scammers often hide their identities well, which can sometimes make tracking them down quite challenging. If this is the case, it may complicate legal proceedings, so make sure that you manage your expectations from the beginning.
Choosing CEL Solicitors for Phishing Email Legal Support
Falling victim to a phishing email can be overwhelming, both financially and emotionally. That’s why consulting a trusted, legal professional who specialises in fraud and scam recovery is essential.
At CEL Solicitors, we specialise in helping individuals recover losses and regain peace of mind.
We assist victims in reclaiming money lost either to individuals responsible for the phishing attack or organisations that failed to protect their information from criminals.
With years of experience and a strong track record in fraud recovery, we provide focused, results-driven legal support tailored to your situation.
Our No-Win, No-Fee promise ensures you can pursue your claim without any upfront costs, giving you access to expert guidance when it matters most.
Ready to pursue your claim against a phishing email attack? Get in touch today for a free, no-obligation consultation. Call 0333 305 4982 for the support you deserve.
