Tip · Digital and cyber · 13 May 2026 · 1 min read

Phishing: four layers of defence for a practice team

NCSC advice on phishing is not just about training. Filtering, verification, MFA and a no-blame reporting culture all matter.

01 / What's changed

Nothing new. The NCSC sets out four layers: make it hard for attackers to reach users, help users spot and report phishing, limit the damage from emails that get through, and respond quickly.
It warns that no training catches every phishing email, so staff awareness on its own is not enough.

All UK practices and PCNs. Many technical controls sit with your GP IT provider, but the habits and processes are yours.

Agree a rule that any email asking to change bank details, pay an invoice or share login details is checked through a second channel, such as a phone call to a known number.
Make reporting a suspicious email quick and simple, and tell staff what happened to their report.
Say clearly that staff will not be blamed for reporting a click. The NCSC notes that people who fear punishment do not report mistakes.
Ask your GP IT provider to confirm that multi-factor authentication is on for the accounts that support it, that admin accounts are not used for email or browsing, and that you have an incident plan you have practised.