DESCRIPTION
Five practical checks for care teams: verify unexpected requests, use trusted contact routes and report suspicious messages or possible compromise promptly.
When
April 2024
Who
Paula Martinez
A convincing email can put care records, accounts or payments at risk. Staff need a simple way to question unexpected requests and report concerns, even when a message appears to come from someone familiar.
Phishing uses impersonation to persuade someone to share information, open a file or take another unsafe action. It can happen at work or at home. A VPN does not establish that a message is genuine.
What Might a Phishing Message Ask You to Do?
A message might ask for a password, a care document or a payment, or direct you to a false sign-in page. Treat unexpected changes to bank details or requests for confidential records as reasons to verify the request through your normal procedures.
Good spelling, a familiar logo or a plausible display name does not prove a message is safe. Check the request in context and make reporting easy. Staff should be able to raise a concern without fear of being blamed for asking.
Build the following checks into induction and everyday work:
Here are five key tips:
1. Verify unexpected requests: Contact the sender through a number or channel you already trust. Do not use contact details supplied only in the suspicious message.
2. Open services directly: Use a known bookmark or the organisation’s official app instead of following an unexpected sign-in link. Treat QR codes and attachments with the same care.
3. Look beyond spelling: Professional writing and branding can be copied. A request that is unusual for the sender deserves checking even when the message looks polished.
4. Pause when pressured: Threats, secrecy or demands for immediate action should not override payment checks or information-sharing procedures.
5. Protect credentials and records: Never give someone your password or authentication code. Verify requests for personal information and use the home’s approved sharing process.
If you have clicked a suspicious link, opened an attachment or shared information, tell your IT or security contact promptly and explain what happened. Follow the incident process, including changing exposed passwords through a trusted route where advised. Managers should assess any affected personal data and use the official reporting guidance linked below.
Phishing uses impersonation to persuade someone to share information, open a file or take another unsafe action. It can happen at work or at home. A VPN does not establish that a message is genuine.
What Might a Phishing Message Ask You to Do?
A message might ask for a password, a care document or a payment, or direct you to a false sign-in page. Treat unexpected changes to bank details or requests for confidential records as reasons to verify the request through your normal procedures.
Good spelling, a familiar logo or a plausible display name does not prove a message is safe. Check the request in context and make reporting easy. Staff should be able to raise a concern without fear of being blamed for asking.
Build the following checks into induction and everyday work:
Here are five key tips:
1. Verify unexpected requests: Contact the sender through a number or channel you already trust. Do not use contact details supplied only in the suspicious message.
2. Open services directly: Use a known bookmark or the organisation’s official app instead of following an unexpected sign-in link. Treat QR codes and attachments with the same care.
3. Look beyond spelling: Professional writing and branding can be copied. A request that is unusual for the sender deserves checking even when the message looks polished.
4. Pause when pressured: Threats, secrecy or demands for immediate action should not override payment checks or information-sharing procedures.
5. Protect credentials and records: Never give someone your password or authentication code. Verify requests for personal information and use the home’s approved sharing process.
If you have clicked a suspicious link, opened an attachment or shared information, tell your IT or security contact promptly and explain what happened. Follow the incident process, including changing exposed passwords through a trusted route where advised. Managers should assess any affected personal data and use the official reporting guidance linked below.
Sources and further reading
Reviewed and updated 28 October 2026.