2 min read
Report a suspicious message
How small teams can report phishing in Microsoft 365 and Google Workspace, and why the report matters.
Reporting a suspicious message is the point of the exercise, even when you are not sure. A report gives the owner a chance to warn the next person. A deleted message helps only you.
In Microsoft 365, use the built-in Report message button and choose phishing. In Google Workspace, use Report phishing. Those buttons send the message to the mail host’s own review, which is the right first tap.
Some companies also ask staff to forward a copy to a mailbox on the company domain. If yours does, the address is shown inside Gradefort Academy after you sign in. Copy it. Do not guess a lookalike. This public article does not publish a mailbox, because a published address becomes a place attackers send junk.
Do not forward the message to the whole company. That spreads the link. Tell the owner, and let them decide who else should hear about it.
If you already clicked, say that too. Include the time and whether you typed anything. A click that is reported in ten minutes is a small problem. A click that is hidden until Friday is how a mailbox gets forwarded.
Gradefort Academy simulations include a button on the lesson page that gives credit for reporting. Use it. The page will say, immediately, that the message was a training exercise.