How to spot a phishing or malicious email
As part of LJMU’s ongoing security awareness programme, the IT Services team will be conducting phishing simulation exercises to ensure that all staff can recognise and report phishing attempts.
What is phishing?
Phishing remains one of the most common ways cyber criminals try to compromise organisations. Emails sent by cyber criminals are designed to trick recipients into clicking malicious links, opening infected attachments, or revealing sensitive information such as passwords or financial details.
Targeted phishing exercises and training for staff
To help keep our data and systems secure, it’s vital that everyone can recognise and report phishing attempts. As part of our ongoing security awareness programme, we’ll be conducting phishing simulation exercises to help build and test these skills in a safe environment.
Staff that fail simulated phishing exercises will be automatically enrolled in mandatory refresher training. This short course will provide practical tips on spotting phishing attempts and avoiding common pitfalls.
Your vigilance plays a critical role in protecting both your account and the University’s information. Thank you for taking this seriously and for helping to strengthen our collective cyber resilience.
How to spot phishing attempts:
-
Unexpected or urgent requests – especially those asking you to click a link, open an attachment, or provide personal information.
-
Suspicious sender addresses or domains – check that the sender’s email address matches who they claim to be.
-
Spelling, grammar, or tone that feels off – phishing emails often contain subtle mistakes or unusual phrasing.
-
Links that don’t look right – hover over them (without clicking) to see the real destination.
-
Generic greetings – such as “Dear user” instead of your name.
What to do if you get a suspected phishing email:
Suspicious emails can be reported to ITS by using the ‘Report Phish’ button (see below) in Microsoft Outlook. With the suspicious email selected, simply click on the ‘Report Phish’ button and follow the on-screen instructions.
