How to Report a Phishing Email at Work: Safe Steps

Report the message through your company’s approved channel first

If you receive a suspicious email at work, use your company’s phishing-report button, help desk portal, or security contact right away. Do not reply, click links, open attachments, forward it to coworkers, or delete it before reporting unless your security team tells you to do so.

A good report gives your team a chance to check whether the same message reached other mailboxes, block related messages, and decide whether any accounts or devices need review. The Cybersecurity and Infrastructure Security Agency, or CISA, advises users to report suspected phishing to their organization’s security or IT team.

According to the FBI Internet Crime Complaint Center’s 2024 report, phishing and spoofing generated 193,407 complaints, making it one of the most commonly reported cybercrime categories. A fast internal report does not prove an attack succeeded, but it gives your organization more time to contain a real one.

What information makes a phishing report useful

Your security team needs the original email and a short account of your actions, not a long technical analysis. Be direct, especially if you clicked or supplied information. Delayed reporting because you feel embarrassed can turn a manageable event into a wider account-access problem.

• The sender’s displayed name and full email address.
• The email subject line and approximate time received.
• Whether you clicked a link, opened an attachment, replied, scanned a QR code, called a listed number, or entered information.
• Whether you entered a password, multi-factor authentication code, payment details, patient information, taxpayer information, or other sensitive data.
• Whether the email appeared to impersonate a client, vendor, executive, bank, Microsoft, the IRS, or another trusted organization.

Do not send passwords, authentication codes, or sensitive client data in an ordinary email to explain the incident. Ask your security contact for the approved secure method if that information is necessary for response.

What to do if you clicked, opened, or entered a password

Report the interaction immediately. A phishing message that was merely received is different from one that led to a click, download, or sign-in. Your team may need to review mail rules, account sessions, multi-factor authentication prompts, endpoint activity, and messages sent from your account.

If you entered your work password into a suspicious site, use a device you trust and follow your organization’s password-reset process. If you approved an unexpected multi-factor authentication prompt, say so in the report. Do not assume that changing the password alone closes the incident, because responders may need to revoke active sessions or check for mailbox forwarding rules.

For accounting and tax practices, phishing can lead to exposure of taxpayer data or unauthorized access to tax software. The IRS explains in Publication 4557, Safeguarding Taxpayer Data that tax professionals should have procedures for identifying and responding to security incidents. Healthcare practices should likewise follow their documented procedures under the HIPAA Security Rule. Whether a notification obligation applies depends on the facts, applicable rules, and counsel’s advice.

Set a simple reporting process before the next email arrives

Small businesses should make the reporting path obvious enough that a new employee can use it under pressure. Put the approved reporting method in onboarding, security awareness training, and your written incident-response procedure. If you have a managed provider, confirm who receives reports after hours and what information employees should include.

The nist incident response framework is a useful starting point because it treats reporting as part of a repeatable cycle of preparation, detection, response, and improvement. The goal is not to make every employee an investigator. The goal is to get timely, accurate information to the people who can assess and contain risk.

A practical policy statement

Use wording employees can remember: “If an email feels unusual, report it. If you clicked or entered anything, report that too. You will not be punished for reporting in good faith.” This approach makes it more likely that staff report near misses and helps you identify recurring impersonation patterns.

Email reporting is only one layer. A defense in depth cybersecurity strategy explained includes multi-factor authentication, endpoint protection, secure backups, email filtering, least-privilege access, and a tested response process. Those controls reduce different parts of the risk, but none makes phishing harmless.

How firm owners should evaluate their email-reporting readiness

Ask a few operational questions: Can employees report a message with one or two clicks? Does someone monitor those reports during business hours? Does your team know how to isolate a potentially affected device, reset access safely, and document decisions? Can you tell whether a reported email reached other employees?

A security operations center, or SOC, is a team or service that monitors and responds to security signals. Read what is a security operations center soc explained if you are deciding whether outsourced monitoring fits your firm. For many small offices, the practical need is not enterprise tooling. It is a clear handoff from an employee report to someone who can investigate the mailbox, account, and endpoint.

Endpoint detection and response can add visibility when phishing leads to a harmful download or suspicious behavior on a computer. Bellator Core combines managed endpoint detection and response, remote monitoring, and Ransomware Rollback® for $33 per computer per month. It is suited to small organizations that want managed endpoint coverage alongside routine monitoring, but it does not replace staff reporting, email security, or a documented incident process. See Bellator Core to review the service scope and fit.

Use reports to improve your defenses

Review phishing reports periodically for patterns, such as vendor-payment impersonation, fake document-sharing notices, QR-code lures, or requests for multi-factor authentication codes. Then update training and technical controls around the pattern you actually see.

Test whether your provider can explain its process in plain language. A cybersecurity company vs msp comparison can help clarify whether you need a provider focused on security response, broader IT support, or both. If you are assessing weaknesses before an incident, learn what is penetration testing and where it fits alongside everyday email and endpoint controls.