A user reporting a suspicious message has done exactly the right thing. Say so — it is the behaviour you want more of, and people who feel foolish stop reporting.
The first question
If they did not interact with it
- 1
Thank them for reporting it
- 2
Have them report it through the approved reporting path
Forwarding to colleagues is not reporting — it spreads it.
- 3
Tell them to delete it afterwards
- 4
Log the ticket so campaign volume is visible
If they did interact with it
- 1
Stay calm and do not lecture
They are already embarrassed. Blame slows down the only thing that matters now, which is speed.
- 2
Escalate immediately
Do not attempt to remediate this yourself at first contact.
- 3
Capture what was entered and when
Credentials, a multi-factor approval, or personal details — and the approximate time.
- 4
Record the message details
Sender, subject, and time received.
- 5
Follow the escalation path exactly
This is a security incident, not a password ticket.