This month we’re running one habit a week for staff. Each one is small, takes less than a minute, and makes a real difference. Forward them to your team.
Habit one is the most useful of the lot.
The one habit
If an email feels off, report it the moment you notice. If you’ve already clicked the link, opened the attachment or typed something in, report it anyway, and say that you did.
Why reporting beats deleting
Deleting a strange email protects you. Reporting it protects everyone else who got the same one, and in a small business that’s often the whole office.
It also costs almost nothing. Over the past year, staff at five of our client businesses sent us six suspicious emails to check. Every one of those checks was logged at between 10 and 25 minutes of our time.
That’s a cheap price for knowing whether an email is safe.
Earlier this year, staff at a professional services firm we support received a fake invoice demanding payment, followed by a second email made to look like it came from someone senior in the firm. They marked it as phishing and sent it to us. We confirmed they’d done exactly the right thing and checked that the filter had caught the rest.
Nobody had to be an expert. They just had to say something.
“But I already clicked”
This is the report that matters most, and the one people are most tempted to skip because they feel embarrassed.
Please don’t skip it. A report ten minutes after a click gives IT time to change a password, sign you out everywhere or check your computer before anything happens. A report two weeks later, or never, gives someone else two weeks inside your mailbox.
Nobody who reports a click should be in trouble for it. Scam emails are written by people whose whole job is to fool busy staff.
When you report, include:
- the email itself, forwarded or reported with the button
- whether you clicked, opened or entered anything, and roughly when
- anything odd that happened afterwards, like a sign-in page or a download
How to report
Use whatever your business has set up. That might be a report button in Outlook, or simply forwarding the email to IT.
If you’re not sure, Microsoft’s guidance for Outlook shows the Report then Report phishing option. Then tell IT as well, especially if you clicked.
Next week, habit two: what to do with a sign-in approval you didn’t ask for.
If your team doesn’t have a clear way to report suspicious emails yet, talk to us.