The Friday Teatime Trap: A Plain-English Phish Intercept for UK SMEs

At 4:07 on a Friday, your office is halfway out of the door. Someone in finance is trying to close the week, the MD is on a train, and the person who usually checks supplier bank details has already left. That is exactly when a certain kind of email tends to land: a polite nudge about an unpaid invoice, a message from 'HMRC' about a refund, or a password-reset alert that looks like it came from Microsoft 365.

These are not sophisticated attacks. They are low-effort fraud, and they work because they are timed for the moment when normal checks get skipped. The Friday teatime slot and the end of the month are a fraudster's friend: approval fatigue is high, people are rushing, and a request that would look odd on Tuesday morning can look like just another job before home time.

Why the filter does not save you

Standard email filtering is useful, but it is not a fraud detector. It looks for known bad links, attachments and sender reputations. It struggles when the message is plain text, comes from a compromised but genuine supplier account, or uses a new domain that has not been seen before. A reply-chain hijack can look exactly like your regular contact because it is your regular contact, just not the person typing.

HMRC impersonation is a good example. The email may not contain a malicious file at all. It just asks you to 'confirm your bank details for a refund' or 'update your VAT contact'. The link goes to a convincing login page. The filter sees a link to a newly registered site and may let it through because there is no attachment and no obvious malware.

Password-reset phish is similar. It arrives when people are already juggling logins. The email says your password expires today and gives you a button. If you are tired, you click, sign in, and hand over the session. Filters cannot reliably tell that apart from a genuine notification.

The three-step intercept routine

This is the routine I would give an office manager who wants something practical, not a 20-page policy. It is deliberately short enough to remember at 4pm on a Friday.

1. Pause the action, not just the email

The first step is to stop the thing the email is asking for: the payment, the bank-detail change, the password reset, the file download. Do not reply, do not forward it to a colleague with 'can you look?', and do not use any phone number or link in the message. If someone is asking for money or access, the email has already done its job if it gets a reaction. Your job is to make sure the reaction is not the one it wants.

2. Switch channel and verify from known details

Use a second channel that you already trust. Ring the supplier on the number in your finance system, not the number in the email. Message the MD in person or on the internal chat, not by replying to the thread. For HMRC, log in to GOV.UK directly rather than through the link. For a password reset, open the admin portal yourself and check whether a reset was actually requested.

The key phrase is 'known details'. Fraudsters are very good at supplying new ones. The intercept only works if you compare the request against a record that the fraudster cannot edit.

3. Record it and pass it on

Log the near miss in a simple shared file: date, sender, what was requested, who spotted it, what happened. Send suspicious emails to the NCSC's Suspicious Email Reporting Service at [email protected]. Tell the team in the next huddle, not in a 40-slide training deck. If a supplier's account really has been compromised, tell them by phone as well, because their other customers are getting the same message.

A staff script that does not sound like a script

Most people freeze when they get a strange payment request. Give them words. Something like: 'Hi [name], I've had an email that looks like it's from you about [payment/sign-in]. Before I action it, can you confirm by phone on the number I have on file? I won't reply to the email or use the details in it.'

For HMRC: 'We don't action refunds or bank-detail changes from an email. I'll check your record on GOV.UK and call the usual helpline if needed.'

For a password reset: 'I'm not clicking that link. I'll open the admin centre myself and check whether a reset was requested.'

That is it. No jargon, no blame. The person who spots it should feel like they have done the right thing, not like they have created extra work.

The Friday habit

The wider lesson is that fraud does not need to be clever if your office is predictable. Friday afternoon and month-end are predictable. So build a small intercept habit around them: a named person on payment checks, a rule that bank-detail changes are always verified by phone, and a five-minute reminder on Friday morning that the quiet hours are not a free pass.

Filters will catch some of it. Your routine has to catch the rest.