Create a Phishing Reporting Process for Your Team
Your team is your best sensor. Make it fast and safe to report suspicious emails, and you will catch attacks far earlier than any tool alone.
Before you start
- ✓A shared channel or inbox where reports can land
- ✓Someone designated to triage reports during business hours
Steps
- 1
Pick one reporting destination: a shared inbox, a Teams or Slack channel, or the built-in Report button in Microsoft 365 or Google Workspace.
- 2
Enable the native "Report Phishing" button in Outlook or Gmail so users can report with one click and the message is removed from their inbox.
- 3
Tell the team exactly what to report: anything asking for credentials, payment, or urgent action, and anything that feels off.
- 4
Promise no blame for false reports. A quick "good catch" reply builds the habit; silence kills it.
- 5
Assign one person to triage reports during business hours and a backup for after-hours, with a target response time written down.
- 6
When a report is a real threat, remove the message from all mailboxes using the admin center or a tool like Microsoft Defender.
- 7
Share a short monthly summary: how many reports, how many were real, and one thing the team learned.