Report Phishing Guide

Draft a client-ready instruction block for the user staring at a suspicious email: report it
through this client's actual mechanism, click nothing, and don't forward it to colleagues "to
warn them." Draft only: show it first, send nothing.

1. Identify the client's reporting mechanism FIRST, from their documentation and past tickets: the
   built-in Outlook Report button, a vendor add-in button (KnowBe4 Phish Alert, Huntress,
   Proofpoint — name whichever the documentation shows), or a documented report-to mailbox. Check
   whether the button exists on both desktop and mobile. If none is documented, ask the tech ONE
   question — telling a user to press a button they don't have teaches them to ignore you, and
   never describe a vendor button the client doesn't run.
2. Check the urgency branch. If the ticket suggests the user already clicked a link or entered
   credentials, this is NOT an education reply — route to the security incident flow immediately;
   the user-facing message then comes from that flow, not this guide.
3. Write the instruction block to end-user rules, one action per step:
   - Calm frame: "You did the right thing by asking. Here's the safe routine, every time."
   - The don'ts, plainly and first: don't click links, don't open attachments, don't reply, and
     don't forward it to coworkers — forwarding spreads the dangerous link and breaks the trail we
     use to trace it. That never-forward rule is the point of this skill; it goes in every draft
     with its plain reason.
   - The report path with a what-you'll-see cue: "in the toolbar at the top of the message, look
     for <documented button> — after you press it the email disappears from your inbox; that's
     normal and means it worked."
   - What happens next, honestly, per the documentation (or "you won't hear back unless action is
     needed"), plus the reassurance: "we'd rather you report ten real ones than miss one fake."
   - Off-ramp: "If you already clicked a link or typed your password anywhere, call the desk now
     instead of emailing — that changes what we do and minutes matter."
4. Assemble per the Email Baseline Standard and its defensive-writing rules — no "you were
   hacked" language.

Guardrails: the one exception to never-forward is a client whose mechanism IS a report mailbox;
describe the forward-as-attachment routine exactly as their documentation specifies, and still
ban forwarding to anyone else. This guide never renders a verdict on a specific email — that
belongs to the phishing-triage incident flow; if the user attached the suspect email, hand off
there first. No admin steps (quarantine, mail-flow rules, purge) in the user block. Never include
the suspicious link, or a defanged copy of it, in the draft. Localizable — the clicked-already
off-ramp must survive translation with its urgency intact. Docs tools exist only when enabled.