You check whether a suspicious email is legit by pausing before you click, looking at the real sender address and where the links actually go, questioning the request itself, and asking your IT partner if you’re unsure. For a contractor, that quick check is what stops a convincing phishing email from turning into a fraudulent payment or a hacked account. When in doubt, it’s always worth a moment to verify.
Phishing emails are now convincing and often personalised, so you can’t rely on spotting bad spelling. Here’s how to judge one.
1. Check the real sender
The display name can say anything. Look at the actual email address it came from. A message claiming to be a supplier or colleague but coming from an odd address is a clear warning sign.
2. Look at the links before clicking
Hover over a link to see where it really goes. If the address looks nothing like the company it claims to be from, don’t click. The same goes for unexpected attachments.
3. Question the request
Most scams create urgency or ask for money, payment-detail changes or login credentials. If an email pressures you to act fast or change where a payment goes, treat it as suspect and verify by phone on a known number.
4. Ask if you’re unsure
You don’t have to decide alone. Forwarding a suspicious email to your IT partner for a quick verdict is far cheaper than clicking the wrong thing. A good MSP would always rather check one too many than miss one.
A real example: two emails checked in time
We support a security and M&E contractor where a staff member forwarded two suspicious messages and asked whether they were safe. We examined the sender, the links and the intent and gave a clear verdict, so the user neither clicked a malicious link nor deleted a genuine business email. Turning a moment of doubt into a quick answer is exactly the point.
For most building-services and M&E contractors, this sits within fully managed IT at about £45 to £100 per user per month, billed per user, with the security and on-site remote access your teams need built in.
Why security and M&E contractors choose First Stop IT
First Stop IT has supported businesses since 2002, including security, fire and M&E contractors and building-services firms with office and site-based teams. We know how these businesses run: hosted desktops for staff on site and in the office, QuickBooks and payroll, secure remote access for field engineers, Microsoft 365 and Google Workspace, and the layered security that protects a firm handling client sites and payments, from MFA and application allowlisting to managed threat detection. We support contractors in Harlow, Bishop’s Stortford and across Essex, Hertfordshire and London. Our credentials include:
- Cyber Essentials Certified
- IASME Cyber Assurance (Gold)
- NCSC Assured Service Provider (Cyber Advisor for Cyber Essentials)
- Microsoft Partner
- Crown Commercial Service Supplier (G-Cloud)
- Quality Principles Certified
We look after more than 2,000 endpoints across 50 companies, we’ve been named a Top 50 UK MSP for three years running, and we support organisations with 10 to 100 employees across Essex, Hertfordshire and London, including Harlow and Bishop’s Stortford.
Book a free IT and cyber security review
Want your team to have someone to check with? Book a free IT and cyber security review with First Stop IT and we’ll be that someone.