Free phishing test • About 2 minutes
Can you spot the phishing email?
This email has just landed in a finance inbox at 4.52pm on a Friday. It hides 8 warning signs, but plenty of it is perfectly normal. Click or tap only the parts you think are wrong. Every harmless part you click counts as a false alarm.
- 1Read the email carefully
- 2Click only what looks wrong
- 3Find all 8 with no false alarms
Brackenford Freight, Karen Whitlock and the other people and companies in this example are invented, and none of the links are live, so clicking is safe.
The answers
The 8 red flags, explained
Finished the test, or want to check your answers? Here is what each warning sign is and why it matters. If you have not tried the email yet, scroll back up first.
Show the answers
- A lookalike sender address. The name is right, but the address is brackenfordfrieght.co.uk, with the i and e swapped. Their genuine emails come from brackenfordfreight.co.uk. Read the address letter by letter, not just the display name.
- Replies go somewhere else. The reply-to address is on brackenford-finance.co.uk, a different domain from the sender. Hit reply and you could be talking to the criminal, not your supplier. A reply-to on a different domain is a common invoice fraud trick, and you often only see it when you press reply, so check it before you answer anything about payments.
- An attachment that is not really a PDF. The attachment ends in .pdf.htm, so it opens a web page in your browser, usually a fake login form, rather than a statement. Windows can hide the .htm ending, so it may just look like Statement_BF-20931.pdf. At 3 KB it is also smaller than you would expect for a real statement.
- New bank details by email. This is the biggest red flag in the email, even though it is worded calmly. Never change who you pay because an email told you to. Call the supplier on a number you already hold, not one from the email, and confirm the change before any money moves.
- The account name does not match. The money would go to an account in the name of Marlowfield Trade Services Ltd, not Brackenford Freight Ltd, and a “payments partner” is a common excuse. When you set up a new payee, your bank checks the name you enter against the name on the account (Confirmation of Payee). Criminals know this, which is why the email tells you the account name in advance: type it in and you may well get a match. A match only confirms the name, not that the request is genuine. If you get a close match, no match or cannot check result, stop and phone the supplier.
- Polite pressure to pay today. There is no shouting and no “final notice”, just a request to pay today or have the account put on hold. Sent at 4.52pm on a Friday, it leaves almost no time to check with anyone. Any deadline that stops you checking is a warning sign.
- Steered away from the phone. It sounds reasonable, but it steers you away from the check that stops most invoice fraud: a phone call to a number you already hold. A genuine supplier should be happy for you to ring.
- A link that goes somewhere else. The button says “View statement”, but the link goes to brackenfordfreight.co.uk.statement-view.net. To see which website a link really goes to, look at the part between https:// and the next single /, and read it from the right. Here that part ends in statement-view.net, so that is the website. Everything before it is just a label the criminal chose. On a computer, hover over a link to see where it really goes. On a phone, press and hold. If it asks you to sign in, stop.
The parts that were fine
- Subject line. The word overdue adds a little pressure, but genuine statements say it too. A dull, factual subject line like this is what real accounts emails look like, and plenty of scams look the same, so the subject alone tells you little.
- Sender name. The display name is correct, but anyone can type any name they like. It is the address next to it that matters.
- To address. It has gone to your normal accounts inbox, which is what you would expect.
- Greeting. Advice often warns about greetings like “Dear customer”, but a general greeting is normal for an email to a shared accounts inbox, so on its own it tells you little.
- Invoice details. The details look right, and that is the point: criminals who get into a supplier’s mailbox can copy genuine invoices. Correct details do not prove an email is safe.
- Thank you line. A polite, normal closing line.
- Signature. A full signature looks reassuring, but it is easy to copy from a real email. If you need to call, use the number you already hold, not one from the email.
- Footer. Standard footer text, found on genuine and fake emails alike.
- Already paid line. Genuine payment reminders often say this. It is a polite, normal line and asks nothing of you.
Notice what is missing, too: there are no spelling mistakes and no threats in capital letters. AI tools now help criminals write clean, convincing emails, so judge an email by what it asks you to do, not by how well it is written.
Invoice and payment scams like this one are covered in more depth in our guide to invoice fraud and business email compromise, and our guide on how to spot a phishing email covers the other common types, from fake password resets to parcel scams.
Why it matters
Phishing is the attack UK businesses meet most
Sources: Cyber Security Breaches Survey 2025/26 (DSIT, April 2026); NCSC.
If it happens for real
What to do if you clicked a phishing link
Clicking happens to careful people. What matters is how quickly you act. These are the steps we give our own clients, in order.
- Tell your IT team straight awayThe sooner they know, the sooner they can lock the account, check for unusual sign-ins and stop the damage spreading. Do not wait to see if anything happens.
- Change the password, from a different deviceIf you typed a password into the page, change it now from a device you trust, and anywhere else you use the same one.
- Call your bank if money or card details are involvedUse the number on the back of your card or your own records, never one from the email.
- Report fraud if you have lost moneyIn England, Wales and Northern Ireland, report it to Report Fraud online or on 0300 123 2040. In Scotland, call Police Scotland on 101.
- Forward the email to report@phishing.gov.ukThis is the National Cyber Security Centre’s Suspicious Email Reporting Service. It analyses every report and works to take scam sites down.
- Then delete itOnce IT and the NCSC have it, delete the email so nobody else on the team clicks it by mistake.
For your whole team
One person spotting a scam is good. A whole team that stops and checks is better.
Criminals only need one person to click. That is why we protect businesses in layers: email filtering to stop most phishing before it reaches an inbox, phishing-resistant multi-factor authentication so a stolen password is not enough on its own, and staff awareness training with phishing simulations, so you can see who would click before a criminal finds out.
See how it fits together on our cyber security services page, or book a free review below and we will tell you where your gaps are.
Send this test to your team
It takes about two minutes, works on any phone and nothing in it is live. A quick way to start a conversation about phishing.
Email it to your teamatsconnection.co.uk/phishing-test/Free • No obligation • Senior engineer • 30 minutes
Find out how exposed your business really is
A senior engineer will look at your email security, Microsoft 365 sign-in settings and backups with you, and tell you plainly what would stop a phishing email like this one, and what would not.
What you get from the review
- Email filtering and sign-in security checked
- Multi-factor authentication gaps flagged
- Backups checked against ransomware
- A plain-English list of what to fix first
If it is urgent, call us on 01903 255 159.
FAQ
Phishing tests: common questions
A phishing test checks whether someone can recognise a phishing email before acting on it. This one shows a realistic but made-up invoice scam with 8 hidden warning signs, mixed in with parts that are perfectly normal. Businesses also run phishing simulations, where safe test emails are sent to staff to see who clicks, followed by short training for anyone who does.
No. Brackenford Freight and the people and companies in the example are invented, and none of the links are live, so clicking any part of it is safe. It is based on the way real invoice and payment scams are written.
Start by sharing this page so the team knows the warning signs. For a proper picture, a phishing simulation sends safe test emails to staff and reports who opened, clicked or entered a password, so training can be aimed where it is needed. We run awareness training and phishing simulations as part of our cyber security services.
Tell your IT team straight away, change the password from a different trusted device if you entered one, and call your bank if money or card details are involved. If you have lost money, report it to Report Fraud on 0300 123 2040, or Police Scotland on 101 in Scotland.
Forward it to report@phishing.gov.uk, the National Cyber Security Centre’s Suspicious Email Reporting Service, and tell your own IT team. Then delete it so nobody else clicks it.
Not completely. Good email filtering stops most phishing before it reaches an inbox, and phishing-resistant multi-factor authentication means a stolen password is not enough on its own, but some emails will still get through. That is why staff awareness matters as the last line of defence.
Because it is how invoice fraud works. Criminals pose as a real supplier and ask you to pay a genuine invoice into their account instead. Always confirm any change of bank details by phone, using a number you already hold, before paying. Our guide to invoice fraud explains more.
