Phishing Emails at Work: Report, Contain and Learn

A suspicious email may imitate a supplier, colleague or familiar online service. The safest response does not depend on an employee proving that it is malicious. Give staff an approved reporting route and permission to pause an unusual request. CISA and FTC guidance provide a starting point for recognizing phishing and protecting business information. For a US workplace, the reporting process should explain what to do with an unexpected attachment, sign-in request or bank-detail change. Staff should not need to open a file or follow a link to collect evidence for the report.

The response changes if someone entered a password, approved a sign-in prompt or sent money. Tell the administrator promptly and describe the actual action, without embarrassment or delay. Use a trusted contact route rather than replying to the questionable message. Preserve relevant details through the approved process, including timing and the affected account. The administrator can decide whether sessions, credentials or payment instructions need containment. If funds may have moved fraudulently, contact the financial institution through a verified route immediately. Avoid making public claims about the incident before the facts are understood.

Put a verified support contact where employees can reach it if email is unavailable. An instruction to email the compromised mailbox creates a circular response. Test an alternative route using a harmless exercise and confirm who receives it.

Use a harmless training example that asks for an urgent supplier-bank change. Ask staff to identify the independent verification route and the person authorized to approve the payment. Do not use real credentials or encourage employees to interact with a live malicious site. Review whether the report reaches someone who can act outside normal office hours. A hypothetical company can have an excellent spam filter and still lose money when a legitimate mailbox is compromised. Verification of unusual financial instructions therefore belongs in the operating process as well as the security training. Update the process after lessons from real reports.