A suspicious email should leave an employee with a clear next action: pause, report it through a known route and let the designated person review it. “Be careful” is too vague to serve as a procedure. Staff need to know where a report goes and what to do if they have already interacted with the message.
CISA’s phishing guidance describes attempts to get people to open harmful links or attachments, disclose personal information or infect devices. Its basic sequence is to recognize the attempt, resist interacting, report it and delete it. At work, that sequence needs a reporting route suited to the team’s actual tools.
Use a short warning-sign checklist
Look at what the message wants you to do before deciding whether it appears convincing. A polished signature or familiar display name does not answer whether the request is legitimate. Give unexpected requests for account information or money an independent check.
- Pressure: an urgent deadline, threat or emotional appeal that pushes you to act before checking.
- Sensitive requests: demands for personal information, financial details or sign-in information.
- Address problems: an email address or link that does not match the claimed sender.
- Unclear destinations: shortened or unfamiliar links that conceal where they lead.
- An unexpected story: a claimed account problem, payment issue or document that you were not expecting.
CISA lists urgency, requests for sensitive information and incorrect addresses or links among common signs. It also warns that phishing can have perfect spelling. Treat grammar as weak evidence: an error may prompt a closer look, but tidy wording does not settle the question.
The FTC explains how phishing messages impersonate familiar companies and use a story to prompt a click or attachment opening. If a message might be real, contact the company through a phone number or website you already know is genuine. Use that independent route instead of the message’s own contact details.
Check the request without following it
For a claimed invoice issue, open the supplier record or use an established contact to ask about it. For an account warning, open the service through the usual saved address or application. Keep the suspicious message untouched while checking. The goal is to establish the request’s origin without depending on the instructions you are trying to verify.
For a request that appears to come from a colleague, use a familiar internal contact method. Ask whether they sent the specific request. If the request concerns changing payment details, involve the person responsible for that business process before any change is made. A security report and a payment approval are different tasks, and both need an owner.
A person reporting a message should not need to investigate it themselves. Avoid asking staff to open attachments or follow links to collect more evidence. The report can begin with what is already visible and a description of what happened. The reviewer can request additional information through the agreed procedure.
Replace a weak reporting instruction
Weak procedure: a hypothetical example
“If an email looks odd, forward it to someone in IT and delete it.” This leaves several questions unanswered. Who counts as IT? What if that person is away? Should the employee forward a potentially harmful attachment? What should someone do after entering a password? The instruction also gives the reporter no way to know whether anyone received it.
Improved procedure: a hypothetical example
“Stop interacting with the message. Use the mail system’s report-phishing control, or contact the designated support channel if that control is unavailable. Include the sender, subject, arrival time and whether you clicked, opened a file or entered information. For an active account or payment problem, call the support number in the internal directory. The support owner will acknowledge the report and advise when to remove the message.”
That paragraph needs to be adapted before use. Replace “designated support channel” with the real route and confirm who monitors it. If the mail system has no reporting control, have the administrator document how to submit the original message safely. Add a backup contact so the procedure still works when the usual reviewer is absent.
Explain the process during onboarding and place it where staff can find it quickly. A short practice exercise can use a clearly labeled sample message. Ask employees to identify the report route without clicking anything in the sample. If they struggle to locate the instructions, improve the location or wording before adding more training material.
What to do after an accidental click
Report promptly and say exactly what happened. Clicking a link, downloading a file, opening that file and entering credentials are different events. The support owner needs that distinction to decide the next action. A useful first report states the time, the device involved and the actions taken, without putting passwords or other secrets into the report.
If you only opened a link, stop interacting with the page and tell support what appeared. Do not return to it to reproduce the experience unless the person handling the incident gives specific instructions. Follow the organization’s device-response procedure. If none exists, ask the designated administrator to determine the next steps rather than improvising changes that could complicate their review.
If you entered a password, use a known genuine route to reach the affected service and alert its administrator immediately. Arrange a password change and an account-access review through that trusted route. Tell the administrator if the password was reused so other affected accounts can be considered. Review MFA and recovery arrangements as part of restoring control.
If you approved a sign-in request you did not initiate, report that approval explicitly. If you downloaded or opened an attachment, tell support which occurred and follow its instructions for the device. A calm factual account gives the reviewer more to work with than “I think I got hacked.” Uncertainty is fine; report what you know and identify what you do not.
If financial information was disclosed or a payment was sent, contact the relevant financial provider through a known genuine channel and notify the person responsible for payments at work. Keep the message and transaction details available for the people handling the case. Do not send additional money or information in response to follow-up demands.
Give the report an owner
The designated reviewer should acknowledge receipt and decide how to handle the message. If others received it, the reviewer can issue a warning through the normal internal channel, describing what to look for without encouraging anyone to open the original. Record the action taken and tell the first reporter when their part is finished.
For external reporting, the FTC guidance includes instructions for reporting phishing. The FBI’s Internet Crime Complaint Center, IC3 accepts reports of internet crime, including business email compromise and phishing-related fraud. Assign external reporting to a responsible person so the information submitted is consistent with the organization’s records.
After the immediate issue, review the reporting process itself. Did the employee find the contact? Was a backup available? Did the first report explain whether any information had been entered? Use those answers to correct the procedure. Encourage early reports by making it clear that staff should report uncertainty and mistakes, not wait until they can prove fraud.
Write a one-paragraph reporting procedure and share it with the team.