A phishing reporting process works when it takes one step, gives a quick human answer, and never punishes the reporter. CISA's guidance says staff should know whom to report to and how, and should verify suspicious messages without using anything inside them. Design for speed first.
Why reporting beats detection
Filters miss things. A person who notices an odd request and tells you within minutes can stop a spread that would otherwise run for days. The metric to care about is time to report, not how many people were fooled in a test.
What to teach people to notice
CISA lists these signs: strange or unexpected requests, urgent language meant to rush you, suspicious links, personal or company specific details that make a fake look real, and messages that appear to come from a known contact whose account may be compromised.
Teach those five. Skip long lists.
What to tell people to do
CISA's steps, adapted:
- Do not reply and do not use links or phone numbers in the message.
- Hover over links to see the destination.
- Verify through a contact method you already have on file.
- If you suspect you were tricked, change the affected passwords immediately.
- Report the message, then delete it.
Step four is where many programs fall short. People who clicked need a safe route to say so quickly.
Make the path short
- A report button in the mail client, or a single shared address like a security mailbox.
- An automatic acknowledgment so the sender knows it arrived.
- A human reply within a stated window, even if only "thanks, this is a scam, no action needed."
- A separate, equally easy path for "I clicked it."
Close the loop
Every report should get an outcome: confirmed phish, harmless, or under investigation. Publish a short monthly summary with examples, with names removed. People report more when they see their reports matter.
Remove blame
If a person who admits clicking is mocked or disciplined, the next person will stay quiet. State in writing that good faith reports are welcome, and mean it.
Measure it
- Median minutes from delivery to first report.
- Share of reports that are real threats.
- Number of people who reported after clicking.
Rising numbers on the first and third are good news.
Quick check
Who should receive phishing reports?
A named person or shared queue that is checked daily. CISA advises making sure employees know whom to report to and how.
Should we delete the message after reporting?
CISA's guidance is to report and then delete it. If your team needs the original for analysis, the report button or forwarding as an attachment preserves it.
Sources
Last reviewed: 19 October 2026.
