Spam
Unwanted bulk email such as advertising, questionable promotions or repeated messages you did not request.
Business Email Security
Spam Protection
Reduce unwanted email, recognise phishing attempts and protect business accounts, money and information from email-based attacks.
Protect Your InboxSpam, Phishing and Spoofing
Not every unwanted message presents the same risk. Knowing the difference helps you choose the right response.
Phishing
A deceptive message designed to steal passwords, financial details, personal information or persuade you to install malware.
Spoofing
A message made to look as though it came from a trusted person, company or email address when it did not.
Warning Signs
One sign does not always prove an email is malicious, but several signs should make you stop and verify.
Unexpected urgency, threats or pressure to act immediately
A sender address that is slightly different from the real organisation
Requests for passwords, verification codes or sensitive information
Unexpected invoices, payment changes or bank-account instructions
Links whose destination does not match the visible wording
Unexpected attachments, especially executable or compressed files
A message that does not match the sender’s normal style or request
Offers, refunds, prizes or warnings that seem too good or alarming
Stop and verify: Never use the phone number, link or contact details inside a suspicious message. Contact the organisation through a trusted website, saved number or known contact.
Protect the Business
Good filtering helps, but account security and staff habits provide essential additional protection.
Use a reputable business email service. Keep its built-in spam and phishing protection enabled and software updated.
Turn on multi-factor authentication. Protect every email account, particularly owners, administrators and finance staff.
Use unique passwords. Store strong, different passwords in a trusted password manager rather than reusing them.
Train everyone who uses email. Teach staff how to inspect senders, verify payment requests and report suspicious messages.
Protect the business domain. Ask the email administrator or provider to configure SPF, DKIM and DMARC correctly.
Maintain backups and recovery details. Keep tested recovery methods, emergency contacts and suitable business-data backups.
Handle a Suspicious Email
Follow a consistent process rather than investigating a dangerous message by clicking through it.
Do Not Interact
Do not reply, open attachments, scan unknown QR codes, call numbers in the message or select its links.
Verify Separately
Contact the supposed sender through a known channel, particularly for payment, payroll or account-access requests.
Report It
Use the email service’s Report Spam or Report Phishing command so the provider can improve filtering.
Tell the Business
Notify the responsible manager or IT support, especially if the email targeted several staff members.
Block When Useful
Blocking can stop repeat mail from one address, but remember that attackers frequently change addresses.
Delete Safely
After reporting and following internal procedures, remove the message and avoid forwarding it normally to colleagues.
Spam Protection Checklist
Use this checklist for every business mailbox.
Spam and phishing filtering is enabled.
Multi-factor authentication is active.
Every account has a unique password.
Recovery email and phone details are current.
Staff know how to report suspicious messages.
Payment changes require separate verification.
Domain authentication has been configured.
Junk folders are reviewed for legitimate mail.
Email apps and devices receive updates.
An incident-response contact is documented.
If Someone Clicked or Responded
Act quickly. Do not hide the mistake—early reporting can greatly reduce the damage.
Disconnect when malware is suspected. Remove the affected device from the network and contact qualified support.
Secure the account. From a clean device, change the password, review recovery details and sign out other sessions.
Tell the appropriate people. Notify the business owner, IT support, bank or affected service immediately.
Check account activity. Look for forwarding rules, sent messages, changed settings, unknown logins and unauthorised transactions.
Preserve useful evidence. Record what happened, when it happened and what actions were taken without continuing to interact with malicious content.
Financial fraud: Contact the bank immediately using a verified number. Do not wait for an email response if money may have been transferred.
Common Questions
Should I unsubscribe from spam?
Use unsubscribe only for legitimate organisations you recognise. Selecting an unsubscribe link in a malicious message can confirm that your address is active or lead to a dangerous website.
Why do legitimate messages enter the spam folder?
Filters are not perfect. Mark genuine messages as not spam, add trusted senders to contacts where appropriate and ask senders to configure their domain authentication correctly.
Does blocking a sender stop all spam?
No. Blocking helps with repeated messages from one address, but attackers can use new or spoofed addresses. Reporting and good filtering are more effective.
Can I trust the sender’s display name?
No. Display names are easy to imitate. Inspect the complete sender address and independently verify unusual requests.
Official guidance: See Gmail’s spam and phishing guidance and Microsoft’s Outlook phishing guidance.