Suspicious Email at Work? What to Do, Step by Step

When a suspicious email lands, the right response takes about two minutes: stop, check who really sent it, verify any request through a contact you already have, report it the company way, and speak up straight away if you already clicked or paid. Those steps only work if the company has set up three things first: a report button or address, a known-number callback list, and a culture where reporting is never punished.

Volume is the reason this deserves a written procedure. The FBI's 2025 Internet Crime Report recorded 191,561 phishing and spoofing complaints, more than any other crime type. The wider controls are covered in email security beyond "don't click the link". This article is the part for the person looking at the message.

What makes a suspicious email different from a normal one?

The FBI defines phishing and spoofing as "the use of unsolicited email, text messages, and telephone calls purportedly from a legitimate company requesting personal, financial, and/or login credentials." The giveaway is rarely the spelling. It is the combination of a familiar name with an unfamiliar request.

Watch for a request to change payment details, sign in through a link, open an unexpected attachment, buy gift cards, or keep something confidential from colleagues. Add a deadline or a reason the normal process cannot be followed and the message deserves a closer look, whoever it appears to come from. How phishing actually works walks through the mechanics.

What must the company have in place first?

Staff can only follow steps that exist. Before anyone faces a convincing email, three pieces of setup decide whether the right response is easy or awkward.

• One obvious way to report. A report button in the mail client or a single address such as phishing@yourcompany, monitored by a named person. If people have to work out who to tell, most will not.
• A known-number callback list. Phone numbers for your bank, top vendors, payroll provider and leadership, recorded from contracts and past invoices, never from an email. This is what makes "call them back" possible in practice.
• A no-blame reporting culture. Thank people for every report, including false alarms and including "I clicked." The person who reports a mistake in five minutes is protecting the company, and the response should make that clear.

Training on its own is not the answer here. A study of over 19,500 employees at UC San Diego Health found "no significant relationship" between recent awareness training and failing a phishing simulation, which does security awareness training work examines in detail. Process and culture do the heavy lifting, as building a security culture explains.

Step 1: Stop before you click, reply or open anything

Do not click links, open attachments, reply, or call any phone number in the message. Do not forward it to colleagues to ask whether it looks real, because that spreads it to more inboxes. Leave it where it is for now.

If the email creates a sense of hurry, treat the hurry itself as information. A real supplier or executive can wait ten minutes for a check. Artificial urgency works on the same lever in sales, and it is just as resistible once you notice it.

Step 2: Read who really sent it

Look at the full sender address, not the display name, and read the domain letter by letter. The FBI gives examples of spoofed domains that imitate a real company's @company.com: "@co-pany.com", "@company-usa.com" and "@companygroup.com." In a separate 2026 warning, it explains that typo squatting "relies on Internet users making mistakes, such as common typos."

Hover over any link without clicking to see where it really goes, and check whether replies would go to a different address than the sender. A mismatch anywhere is enough to move on to verification.

Step 3: Verify the request through a contact you already have

If the email asks for money, a password, data or a change of any kind, confirm it on a channel the sender does not control. CISA's advice is to contact the company directly and "do not use contact information provided on a website connected to the request; instead, check previous statements for contact information." That is exactly what the callback list is for.

For payment changes in particular, the FBI recommends using "secondary channels and/or two-factor authentication to verify requests for changes in account information." A request to update bank details is the opening move of business email compromise, and it deserves a phone call every single time.

Step 4: Report it the company way

Use the report button or the reporting address, then delete the message. Report it even if you did nothing wrong and even if you are fairly sure it was harmless. One report can let IT pull the same email from every other inbox before someone less careful opens it.

If you are unsure, report anyway. A false alarm costs the reviewer a minute; a missed campaign can cost far more. Teams that thank people for reports get more of them.

Step 5: If you clicked, replied or paid, say so straight away

Tell IT or your manager right away and give them the details: what you clicked, what you entered, what you sent. If you typed a password, change it from a device you trust and expect IT to sign out your sessions. If you approved an MFA prompt you did not start, say that too.

If money moved, speed matters. The FBI's 2025 report says that if you discover a fraudulent transfer, "time is of the essence. Immediately, contact your financial institution and request a recall of the funds," and then, "regardless of the amount lost, file a complaint at www.ic3.gov." What happens when you get hacked sets out what the following days usually look like.

Where else can a suspicious email be reported?

Inside the company first, always. Beyond that, the FTC's phishing guidance says: "If you got a phishing email, forward it to the Anti-Phishing Working Group at [email protected]." Phishing texts can be forwarded to 7726 (SPAM), and fraud can be reported to the FTC at ReportFraud.ftc.gov.

Losses and business-targeted fraud go to the FBI at ic3.gov. IC3 notes that it "will never directly contact you for information or money," so any follow-up message claiming to be from IC3 and asking for payment is another scam.

Not sure? Check before you act

The short version: stop, and do not click, reply or call the number in the message. Read the real sender address and link domain letter by letter. Look the company up yourself and call back on a number you already have. If your company allows it, screenshot the message (crop out customer and personal data, never upload an attachment) and ask your approved AI assistant whether the company is real, the domain matches, and it fits a known scam, treating the answer as a second opinion. Report it the company way. If money or a login was involved, call your bank to request a recall and file at ic3.gov. The full version, covering texts, calls, DMs and websites too, is how to check if a message is a scam.

At Kief Studio we build the verification into the systems themselves, so a payment change or a login approval cannot go through on one person's say-so, whatever the email says. We also run remote team sessions on exactly this: the emails your staff actually receive and the checks that stop them. In-person sessions in Central Massachusetts are available, scoped in advance. Brian Gagne leads the security engineering; briansgagne.com goes deeper on the technical side.

Related reading

• Email security beyond "don't click the link"
• How to check if a message is a scam
• What is business email compromise?
• Building a security culture when everyone thinks it's IT's job

Frequently Asked Questions

What should I do with a suspicious email at work?

Do not click, reply or open attachments. Check the real sender domain, verify any request through a contact you already have, then report it using your company's report button or address and delete it.

Should I forward a suspicious email to a colleague to check it?

No. Forwarding spreads it to more inboxes. Use the company reporting route instead, so the person responsible can check it and remove copies from other mailboxes.

What if I already clicked a link in a suspicious email?

Tell IT straight away. Change any password you entered from a trusted device, and if money was sent, call your bank to request a recall and file a complaint at ic3.gov, as the FBI advises.

Where do I report a phishing email outside my company?

The FTC advises forwarding phishing emails to [email protected] and reporting fraud at ReportFraud.ftc.gov. Financial losses and business fraud should also be reported to the FBI at ic3.gov.

How common are phishing emails?

Phishing and spoofing was the most-reported crime type in the FBI's 2025 Internet Crime Report, with 191,561 complaints.