Why reports matter more than perfect staff
No email filter catches everything, and no amount of training makes people immune to a well-crafted scam. What you can rely on is that, out of a team of twenty, at least one person will usually notice a fake message. If that person reports it quickly, IT can remove the same email from everyone else's inbox before anyone else clicks. Reports also catch the cases where someone has already clicked. A staff member who says 'I just typed my password into something odd' gives you minutes to respond instead of days. That speed is often the difference between a minor reset and a serious incident.
Pick one clear reporting method
Confusion kills reporting. If staff aren't sure whether to forward a message, phone someone, post in a chat or just delete it, many will do nothing. Choose one method and make it the obvious path. In Microsoft 365, a report button in Outlook sends the message to your security team and to Microsoft in a single click. Google Workspace offers similar reporting in Gmail. If you don't have a button, a single address such as a dedicated security inbox works, as long as someone checks it. Explain the method at induction, put it on a one-page guide, and repeat it whenever you talk about security.
Extend the same method to texts, phone calls and chat messages. A staff member who gets a strange text claiming to be from the boss, or a call asking for remote access, should know that it's just as welcome in the report channel as a phishing email. A quick screenshot or a one-line note is enough; the point is that IT hears about it.
Respond to every report, quickly
Nothing stops reporting faster than silence. When someone reports a message and hears nothing, they assume nobody cares. A short reply, such as 'Thanks, that's a phishing email, we've removed it from other inboxes,' or 'Thanks for checking, that one is genuine,' takes seconds and teaches more than a training video. Agree who handles reports and how fast. In a small office it might be the office manager plus your IT provider. If reports go to an outside provider, make sure they are logged and answered like any other support request.
Make 'I clicked' a safe thing to say
The hardest report to make is the one where someone admits they fell for it. If a past mistake was met with blame, gossip or a disciplinary meeting, people will hide the next one. Leaders need to say clearly and often that reporting a mistake quickly is the right thing to do, and that the only real failure is staying quiet. Owners and managers can help by sharing their own near misses. Hearing the boss say 'I nearly fell for one of these last week' makes it much easier for a junior staff member to speak up.
Use reports to improve your defences
Every report is information. Look for patterns: are fake invoices arriving from a particular lookalike domain, are scammers using a specific supplier's name, or is one department being targeted? Use that to adjust email filtering rules, block domains, warn suppliers or focus training where it's needed. Keep a simple log of reports and outcomes. Over time it shows whether filtering is improving, which scams are trending, and whether staff are reporting more or less. That's useful evidence for insurance questionnaires and for deciding where to spend your security budget.
Simulated phishing, done fairly
Simulated phishing emails, sent by your IT provider to test staff, can be useful if they're handled well. The aim should be to practise reporting, not to catch people out. Measure how many people report the test, not only how many click, and praise the reporters. Avoid tests that use upsetting themes such as fake pay cuts or redundancies, which damage trust. Follow up each round with a short explanation of the clues people could have spotted, and keep the tone supportive.
Include reporting in your wider security habits
Reporting works best alongside other basic protections: multi-factor sign-in, regular updates, good backups and clear rules for verifying payments. Together they mean a missed scam is caught early and a mistake can be undone. If you'd like help putting the pieces in place, an IT health check from Office IT looks at email reporting alongside the rest of your setup. Revisit the process once a year. Ask staff whether reporting is easy and whether they got useful answers. Small tweaks based on their feedback keep the habit alive.
In short
- One simple reporting method beats several confusing ones.
- Reply to every report quickly, even when the message is genuine.
- Make admitting a click safe; speed matters more than blame.
- Use reports to tune filters and target training.
- Measure reporting rates in phishing tests, not just clicks.