Remove the need to be certain
The NCSC invites reports of emails that feel suspicious even when the recipient is not certain they are scams. It also advises against clicking links in a suspicious email. For a business, our recommendation is to make that same permission to ask for help explicit in the staff instructions.
Write a short instruction naming your organisation’s reporting route. State what the colleague should do if they cannot find the reporting button or reach the usual contact. Avoid asking staff to investigate a link themselves before deciding whether the message deserves attention.
Explain the internal and external routes
The NCSC’s linked guidance explains how to submit a suspicious email to its reporting service. It says the service analyses reported messages but cannot tell the sender the outcome of the review. Do not tell colleagues to wait for a personal verdict from that service before raising a workplace concern.
Have your security or support owner explain how external reporting fits your organisation’s internal process and information-handling rules. Keep the instruction practical: who receives the workplace report, what happens next and how to escalate an urgent concern. Do not assume that an external submission has also notified your own IT team.
Give someone who already clicked a clear next step
Our suggested staff wording is: if you already followed a link, entered information or opened an attachment, say so when contacting support. Describe what happened and roughly when. Do not paste passwords or other secrets into a ticket to explain the incident.
The NCSC distinguishes suspicious-email reporting from reporting a crime and provides separate guidance for people who have responded to a scam. Your internal procedure should likewise direct an affected colleague to the responsible incident contact promptly. Let the incident owner assess the response and relevant reporting routes; a general awareness message is not an incident investigation.
Rehearse the route without a live threat
For a fictional professional-services firm, the support lead runs a short, announced exercise using an invented message with no active links or attachments. A colleague is asked to find the approved reporting route and explain what they would say if they had already interacted with the message. The exercise tests the instruction, not the colleague’s ability to spot a cleverly disguised scam.
Record where the colleague needed help and fix the unclear step. Ask the team handling reports to confirm that the route reaches a monitored destination and that urgent cases have a named escalation owner. Finish with a usable instruction and a tested handover, rather than an inbox address that nobody has checked.
Sources
Practical suggestions in this article are editorial recommendations. The source supports the guidance attributed to it.
- NCSC · Reporting suspicious email ↗
Checked 26 October 2026
Something needs correcting?
Get in touch to explain which claim needs attention and share the supporting source.