How to Respond When an Employee Reports a Phishing Email

A quick report can limit exposure, but deleting the message before preserving useful indicators may make investigation harder.

Checks to make

Ask the employee not to click further or forward the message externally. Preserve headers through the approved reporting process, identify any clicked links or entered credentials, and check sign-in activity. Escalate suspected credential entry promptly and communicate through a trusted channel.

When to get help

Security support can help triage reports and improve a repeatable phishing response process. Informatix Systems can assess the symptoms, evidence, and next steps. Contact Informatix Systems to discuss this issue.