COMPUREP / Email
Spot and report a suspicious message
A calm, repeatable check for unexpected emails, payment changes, QR codes and sign-in requests.
PDF · 2 pages · Printable checklist and action record
Before you start
Get the right things ready.
Know your company's reporting route and a trusted telephone number for your IT team. Payment approvers should have an independently maintained supplier contact list.
Work through the steps.
Pause before interacting
Treat unexpected urgency, a changed bank account, a password request or an unfamiliar attachment as a reason to pause. A familiar display name or polished logo is not enough to trust a message.
Do not open the attachment, scan its QR code, reply or enter credentials to investigate. On a phone, avoid tapping a link just to see where it leads.
Verify through another route
For a payment or sensitive-data request, call the person using a number already in your records. Do not use the number or contact button supplied in the suspicious message.
If the request appears to come from a colleague, confirm it in person or through a known channel. Continue the normal approval process even if the sender claims an exception is urgent.
Report, then follow guidance
In supported, configured Outlook versions, select the message, then Report and Report phishing. If that option is absent, use your organisation's reporting process; do not forward a live attachment widely.
If you clicked, shared information or approved a sign-in, contact IT promptly and say exactly what happened. Reporting a message alone does not resolve a potentially compromised account.
Further reading
Official guidance.
Original COMPUREP guidance, informed by the sources below. Product screens and policies can change. Sources reviewed 15 October 2026.
Put the guidance into context
Let's make it work for your business.
Bring the checklist to your next conversation with our team.