The everyday decision matters
A message announces an invoice, asks you to sign in or demands an urgent approval. It is not always possible to decide with certainty whether it is dangerous while getting everyday work done. A business therefore needs a simple way to handle uncertainty. Employees should know whom to contact, which details are useful and what to avoid until they receive advice. Reporting a concern is worthwhile even when the message later turns out to be harmless.
Check without following the sender's instructions
Unexpected urgency, unusual payment instructions and requests for account credentials deserve attention. A familiar display name does not by itself prove who sent a message. Verify a surprising request through a contact route you already know, such as a telephone number you select yourself. Do not rely on the number included in the suspicious message. Open a familiar service through your own bookmark instead of using the supplied sign-in link.
Make the report useful
Record when the message arrived, its subject and the workstation involved. Also explain whether you have already opened a link, downloaded a file or entered information. These details help the responsible IT team decide what to investigate next. Forward the message only through the agreed reporting route. Sending it to every colleague may spread dangerous content and make an organised response harder. Avoid adding passwords or confidential customer information to the report.
After a click, speak up
If something has already happened, report it promptly and factually. Do not delete every trace on your own or experiment with more links. Follow your IT team's agreed procedure. Rehearse a harmless example with colleagues from time to time: who can be reached, what information is needed and how will a warning reach the people actually affected? A documented process should work during a busy day and should never embarrass employees for honestly reporting a mistake or concern.
Further reading: CISA: Recognize and Report Phishing.