# Phishing: four layers of defence for a practice team

> NCSC advice on phishing is not just about training. Filtering, verification, MFA and a no-blame reporting culture all matter.

- Published: 13 May 2026
- Type: Tip
- Topic: Digital and cyber
- For: Practice managers, PCN leads
- Applies to: UK-wide
- Review: Reviewed by the Abtrace team
- Web page: https://ontherecord.abtrace.com/posts/phishing-defences-for-practice-teams/

## What's changed

- Nothing new. The NCSC sets out four layers: make it hard for attackers to reach users, help users spot and report phishing, limit the damage from emails that get through, and respond quickly.
- It warns that no training catches every phishing email, so staff awareness on its own is not enough.

## Who it affects

All UK practices and PCNs. Many technical controls sit with your GP IT provider, but the habits and processes are yours.

## What to do

- Agree a rule that any email asking to change bank details, pay an invoice or share login details is checked through a second channel, such as a phone call to a known number.
- Make reporting a suspicious email quick and simple, and tell staff what happened to their report.
- Say clearly that staff will not be blamed for reporting a click. The NCSC notes that people who fear punishment do not report mistakes.
- Ask your GP IT provider to confirm that multi-factor authentication is on for the accounts that support it, that admin accounts are not used for email or browsing, and that you have an incident plan you have practised.

## Sources

- [NCSC: Phishing attacks: defending your organisation](https://www.ncsc.gov.uk/guidance/phishing)
- [NCSC: Small Business Guide](https://www.ncsc.gov.uk/collection/small-business-guide)

Published by Abtrace on On the Record (https://ontherecord.abtrace.com/). Summaries only; always check the linked source.