I was recently called into my boss's office because our security system supposedly flagged me for interacting with too many phishing emails. The messages they showed me were extremely obvious spam, and I recognized them because I had reported them using Outlook's built-in phishing button. I never clicked any links or opened attachments. My boss said the alerts were generated whenever I interacted with a suspicious message, but the alert itself seemed to indicate that I had clicked something. From an administrator's perspective, does using Outlook's Report Phishing button create this kind of alert, and is that normally the correct way to handle suspicious emails?
4 Answers
Reporting a message as phishing normally creates a user submission in Microsoft’s security portal and may generate an informational alert for administrators. That alert identifies the message and the reporting mailbox, but it does not necessarily mean you opened a link or attachment. Your organization should verify the event details before treating it as evidence of a click.
There can be two different reporting buttons. Some organizations install their own phishing-reporting add-in that sends messages to the internal security team, while Outlook’s built-in button submits the message to Microsoft Defender for analysis. Both can be legitimate, but a phishing-training platform may record them differently. Ask IT which button they want employees to use and whether the built-in Microsoft submission is integrated with their monitoring process.
A custom reporting button is often the safer choice when the company uses a separate security or training platform, since it sends the report directly to the team that reviews it.
Some automated security services inspect reported messages by opening links or scanning them in a sandbox. Poorly configured phishing simulations can interpret that automated inspection as a user click. Well-designed training systems exclude those scanners or use special handling, so this is usually a configuration problem rather than proof that the employee clicked anything.
The same issue can happen with several security-training products. The administrators need to configure their safe-link and automated-scanning exceptions correctly.
You generally did the right thing by reporting the messages, but the organization’s documented procedure takes priority. Some companies want employees to use a specific add-in, while others prefer deleting the message or sending it to a designated reporting mailbox. IT should clearly explain the process and make sure its alerts distinguish between reporting a message and clicking something inside it.
That makes sense. My boss apparently had never seen one of these alerts before and misunderstood what it represented.