Should employees report a phishing e-mail even if they did not click it?

Yes. A reported message lets IT remove the same e-mail from every other mailbox, block the sender and the link, and warn the colleague who might have clicked it tomorrow. Phishing usually goes to many people in the same company at once, so one early report can protect dozens. Make reporting easy: a report button in the mail client or a single forwarding address, and a quick thank-you every time, including for false alarms. Never punish a report, even when the person admits to clicking: fear of blame is what turns a five-minute fix into a three-week incident. Measure success by how many people report and how quickly, not only by how few click. Reports also show IT which lures are reaching staff, which helps tune the mail filters and the training.

← All 29 questions on Phishing and e-mail aftermathAll topics