Phishing email reported by staff: the first ten minutes, who to tell, what to check and how to close the case

At 9:12 a colleague writes in the chat: "I got a strange email from our bank, should I be worried?" Three people reply with a shrug emoji, one says it looks fine, and the message stays in the inbox. Nobody owns the question. This is how a single phishing email turns into a week of cleanup.

The fix is not a security product. It is a routine of about ten minutes that everybody knows and one person owns. This article describes a version that fits a company of ten to fifty people.

Minute 0–2: respond to the reporter

The first reply matters more than it seems. People report suspicious emails only when the answer is quick and friendly. If the reply is a lecture, or silence, the next suspicious email will be quietly deleted, or worse, clicked.

Send a short message: thanks, please do not click or forward the email, and one question. The question is: did you click a link, open an attachment, reply or enter a password? Ask it without blame. The honest answer to this one question decides what happens next.

Minute 2–5: sort the case into two paths

Path A: nobody interacted with the email. The email only needs to be removed and checked. Continue below.

Path B: someone clicked, opened an attachment, replied or typed a password. Treat this as an incident. Do these steps in order:

1. If a password was entered, change it now, and on any other service where the same password is used. If the company uses a password manager, this takes minutes instead of hours.
2. End the active sessions of that account, if the service allows it, and make sure two-step verification is on.
3. If an attachment was opened on a computer, disconnect that computer from the network and call whoever looks after IT.
4. If the email asked for a payment, call the bank on a number you already know, not one from the email.

Write down the time of each step. You will need it later.

Minute 5–8: look at the message itself

Without clicking anything, look for the common signs. None of them is proof, but together they usually make the picture clear:

• The sender address differs slightly from the real one, or the display name does not match the address.
• The message creates urgency: today, immediately, account will be closed.
• The link text says one thing, and hovering shows another address.
• The request is unusual for that sender: new bank account, gift cards, a "quick favour" from the owner.
• The greeting is generic, or the attachment is an unexpected invoice.

If the message claims to come from a colleague, a supplier or a bank, confirm with them through another channel, a phone call or a separate chat. Do not use the contact details from the email.

Minute 8–10: check who else got it

A phishing campaign rarely stops at one mailbox. Ask the person who administers email to search for the same sender or subject across all mailboxes, and remove the message from the ones where it is still unread. Most business email services offer this search; if yours does not, send a short note to all staff with the subject line and sender, and ask them to delete the message.

At the same time, report the message to the mail provider using the built-in "report phishing" button, and block the sender address. This is a small step that improves filtering for everybody.

Who does what

Put these roles on one line in your internal notes:

For a small company the handler and the email administrator can be the same person. What matters is that a name stands next to every row, including the deputy.

How to close the case

A report is closed only when a short note exists. Five lines are enough:

1. When the email arrived and who reported it.
2. What kind of message it was, in one sentence.
3. Whether anyone interacted with it, and what was done.
4. How many mailboxes received it and whether it was removed.
5. What, if anything, should change, for example a new filter rule or a reminder to staff.

Send the reporter a final message: what the email was and what you did. People who see the result keep reporting. If the case was path B, review it later in the same blameless way as any other post-incident review: a timeline, the fix and a follow-up date.

Make the next report easier

• Add a one-click way to report. Many mail clients have a report button; if not, a shared mailbox such as a "security" address on your own domain works.
• Put the handler's name and the routine on the same page as other onboarding material, and include it in the new employee access checklist.
• Once a quarter, share one anonymised example with staff: what it looked like and what gave it away.

Common mistakes

• Blaming the person who clicked. They will stop telling you next time.
• Deleting without checking others. One removed message can leave twelve in other inboxes.
• Verifying through the email itself. Phone numbers and links in a suspicious message belong to the sender.
• No log. Without times and steps you cannot say afterwards what was exposed.
• No owner. If everybody may handle it, nobody does.

How to start

1. Name the handler and the deputy this week.
2. Write the reply to the reporter and the one question, and save them as a template.
3. Find out how your email service searches and removes a message across all mailboxes.
4. Agree the five-line closing note and where it is stored.
5. Tell the team how to report and that reporting is always welcome.

Summary

A reported phishing email is a small gift: someone noticed. If the answer is fast, the one question is asked and a named person follows ten minutes of simple steps, most cases end with a deleted message and a short note. The cost of preparing this is an hour, and it prevents the expensive cases.

Sources

• Our related articles linked above.
• The routine is common practice for small companies and is offered as a practical guide. It is not legal or insurance advice. No client results or market figures are claimed in this article.