Pulp sci-fi illustration of a uniformed woman at a spaceship console holding up a glowing envelope with a fishing hook attached, a red warning lamp flashing beside her

Phishing checklist: spot it, report it, beat MFA fatigue and QR scams

A practical checklist for staff and small teams: how to spot a phishing message, what to do about a flood of sign-in prompts or a QR code in an email, and how to report it without fuss. Based on NCSC and CISA guidance, checked on 25 October 2026.

Spotting it is only half the job

The NCSC’s guidance for organisations is blunt on this point. Phishing defences that rely mainly on people spotting bad emails, it says, risk “wasting both time and money without improving security”, and some attacks “will always get through” (NCSC, Phishing attacks: defending your organisation (opens in a new tab)). It sets out four layers: make it hard for attackers to reach people, help people spot and report what does arrive, limit the damage from the ones that land, and respond quickly.

This checklist covers the second layer, plus what everyone should do when the first one misses. The aim isn’t to turn staff into forensic linguists. It’s to make “this looks odd, I’ll report it” the reflex, and to make reporting cheaper than ignoring it.

The tells

Bad spelling used to be the giveaway. The NCSC now warns that scams “are getting smarter and some even fool the experts” (NCSC, Phishing scams: how to spot them (opens in a new tab)). So look at what a message wants, not how well it is written.

  • Urgency or a threat. An account about to close, a fine about to land, a director who needs it done “before the meeting”.
  • A request to sign in, pay or change bank details. Especially by a route the sender doesn’t normally use.
  • Someone you trust, slightly off. CISA’s phishing guidance lists impersonating supervisors, colleagues and IT staff, and moving the lure to text messages, chat apps and spoofed phone calls (CISA and partners, Phishing Guidance: Stopping the Attack Cycle at Phase One, October 2023 (opens in a new tab)).
  • A link or attachment you weren’t expecting. Including a “shared document” that wants your password before it will open.

The check that works on all of them is the same: contact the person or organisation by a route you already trust. The NCSC’s advice: “Don’t use the numbers or address in the message”, use the details from the organisation’s official website (NCSC (opens in a new tab)). If the boss really does need gift cards, the boss can survive a phone call.

MFA fatigue: when your phone won’t stop asking

If an attacker already has your password, push-notification sign-in has a weak spot. CISA describes “MFA fatigue”, also called push bombing, as an attacker bombarding a user with approval prompts “until the user either approves the request by accident or out of annoyance” (CISA, Implementing Number Matching in MFA Applications, fact sheet, October 2022 (opens in a new tab)). A prompt you didn’t ask for is not a glitch. Assume someone has your password, deny it, and report it.

  • Never approve a prompt you didn’t start, not even to make it stop.
  • Report unexpected or repeated prompts straight away. CISA recommends training users to report “unknown or bulk confirmation requests”.
  • Treat a follow-up call from “IT” asking you to accept the next prompt as part of the same attack.
  • Change the password for that account, from a device you trust.

QR codes: a link wearing a disguise

A QR code is just a link you can’t read. The NCSC says QR codes are “increasingly being used in phishing emails”, sometimes called “quishing”. It gives the reasons: not every security tool scans images, and people tend to scan with a personal phone that may lack the protections of a work laptop (NCSC blog, QR codes: what’s the real risk?, 8 February 2024 (opens in a new tab)).

  • Be wary of any email that asks you to scan a code, particularly to “re-verify” an account or sign a document.
  • Use the QR scanner that comes with your phone rather than one from an app store, as the NCSC recommends, and read the web address it shows before you open it.
  • Out and about, take care too: the NCSC says most QR code fraud happens in open spaces such as stations and car parks. Check for a sticker on top of the real code.
  • If a page reached by QR code asks for a password or card details, close it and go to the service directly.

Reporting: fast, free and blame-free

Report inside your organisation first, using whatever button or address your IT team has set up. The NCSC tells organisations to make reporting easy and to give quick feedback, and to avoid a blame culture so that people “feel supported to come forward” even when they have clicked (NCSC (opens in a new tab)). Then, in the UK:

Outside the UK, use your national reporting route. In the US, that’s the service listed on CISA’s Recognize and Report Phishing page (opens in a new tab).

If you’ve already clicked

The NCSC’s first instruction is “don’t panic” (NCSC, Phishing: what to do (opens in a new tab)). Tell IT straight away, because minutes matter more than embarrassment. If you entered a password, change it, and change it anywhere else you used it. If you gave bank details, call your bank. If you installed something or opened a file, run a full scan and let IT look at the device. Criminal crews follow the same pattern at scale: see our write-up of the SafePay joint advisory.

The checklist

Phishing: spot it, stop it, report it (print or pin this; based on NCSC and CISA guidance, checked 25 October 2026)

  • ☐ Does it push me to act fast, pay, sign in or change bank details?
  • ☐ Have I checked with the sender by a route I already trust, not the one in the message?
  • ☐ Did I start this sign-in? If not, deny the prompt, report it and change the password.
  • ☐ QR code in an email? Our advice: don’t scan it. Go to the service directly.
  • ☐ Reported internally, then forwarded to report@phishing.gov.uk (emails) or 7726 (texts)?
  • ☐ Already clicked? Tell IT now, change the password, call the bank if needed.

For whoever runs IT

Staff vigilance is the backstop, not the wall. The NCSC’s first layer includes anti-spoofing controls (DMARC, SPF and DKIM) and filtering before mail reaches anyone (NCSC (opens in a new tab)). For sign-in, CISA “strongly urges all organizations to implement phishing-resistant MFA”, and recommends number matching as an interim fix where push approval is still in use (CISA, Implementing Phishing-Resistant MFA, fact sheet, October 2022 (opens in a new tab)). Our authentication checklist covers that move in more detail. Give people a one-click report button, and say thank you when they use it.

Follow Cyber-Threat.net RSSFeedly (opens in a new tab)X (opens in a new tab)Bluesky (opens in a new tab)LinkedIn (opens in a new tab)