In a small company, a suspicious email usually gets one of three reactions. The person ignores it, asks a colleague across the desk, or clicks to see what happens. None of these tells the rest of the team that a message is going around.
A reporting routine does not need a tool or a policy document. It needs one address, a few clear rules and a promise that someone answers.
One address
Create one mailbox or alias, for example report@yourcompany.com, and tell everyone to forward doubtful messages there. Name two people who read it: the owner of the routine and a deputy for holidays.
Make forwarding as easy as possible. Show people once how to forward a message as an attachment, because that keeps the original headers, and put the instructions in the signature of the welcome email. If it takes more than 30 seconds, people will skip it.
Report anything that feels wrong, not only obvious fraud. A message that turns out to be harmless costs a minute. A missed one can cost much more (see what to do in the first ten minutes after staff report a phishing email).
What not to do
Put these rules on one short page:
- Do not click links or buttons in the message.
- Do not open attachments, especially invoices, shipping notices and documents you did not expect.
- Do not reply, and do not call a phone number written in the message.
- Do not forward it to colleagues to ask what they think. Forward it only to the reporting address.
- Do not delete it yet. Keep it until you get the answer.
If someone has already clicked or entered a password, they should say so at once. Say this plainly and without blame: reporting a mistake early is what limits the damage. Changing the password and signing out of other sessions is the first step, and a password manager makes that faster (see rolling out a password manager in a small company).
An answer within one working day
The promise matters more than the speed. Agree that every report gets a reply within one working day, with one of three answers:
- Safe. Why it is safe, so people learn what a real message looks like.
- Suspicious. What to do: delete it, block the sender, and whether anyone else received it.
- Not sure. You are checking and will say more by a given time.
If the first reply is only "received, I am looking at it", that is already enough to keep people reporting. Silence is what ends the habit.
When a message is confirmed as malicious, send a short note to the whole team the same day: what the subject looked like, what it wanted, and what to do if they received it.
Collect examples
Keep a shared folder of reported messages. Remove names, addresses and anything personal before saving. Add one line to each: what made it suspicious and what the outcome was.
After a few months you have the company's own set of examples. They are more convincing than generic ones, because people recognise the supplier names, invoice styles and tone they see every day.
A 10-minute lesson each month
Once a month, show one example at the start of a regular meeting. Ask two questions: what would make you doubt this, and what would you do? Then give the answer in one minute.
This works better than a long annual training. The lesson is short, current and from your own mailbox. Rotate through the types: a fake invoice, a request to change a bank account, a shared-document link, a message from "the boss" asking for a quick favour. Requests involving money should also follow your payment rules (see invoice approval in a small company).
Check that it works
Every quarter, look at the reporting folder for five minutes:
- How many reports came in, and from how many different people?
- Was every report answered within a day?
- Did the same type of message appear more than once?
If one person sends everything and the others none, ask why. Usually the reason is that the process feels slow, or that someone was once made to feel foolish. Fix that first.
Common mistakes
- No named reader. Reports go to an address nobody watches.
- No reply. People learn that reporting is pointless.
- Blame. The person who clicked hides it, and the damage grows.
- Long rules. Nobody remembers a ten-page policy.
- No examples. The training feels abstract and is forgotten.
Summary
Set up one address and name who reads it, write down what not to click or reply to, answer every report within one working day, keep a folder of real examples, and use one of them each month for a 10-minute lesson. It takes little time and gives a small team a habit that works without special tools.
Sources
- Common practice for small businesses, offered as a practical guide. No client results or market figures are claimed in this article. Adjust the address, the roles and the response time to your company.
