Help For employees
Report a suspicious email in Microsoft 365 Outlook
The PhishTrainer button icon in your mailbox
On this page
What the Report button is for
The Report button in the “PhishTrainer” group sends a suspicious email (phishing or spam) to your organization's security team in one click. Use it as soon as you receive an email that looks doubtful to you.
Before reporting: do not click any link, do not open any attachment, do not forward the email and do not reply to it.
Where to find the button
The button appears when you open a received email. It does not appear while you are writing a message.
It is available in Outlook on the web, the new Outlook for Windows, Microsoft 365 Outlook (desktop) and Outlook mobile (iOS, Android).
Reporting an email, step by step
- Open the suspicious email.
- Click Report. The PhishTrainer pane opens.
- For the question “What do you want to report?”, choose:
- Phishing: link, attachment, request for money or credentials.
- Spam: unsolicited advertising, no apparent danger.
- For the question “Did you interact with this email?”, tick what you did, otherwise leave blank:
- I clicked a link
- I opened an attachment
- I entered a password or personal information
- I replied or called the number given
- Click Send report. The pane shows “Sending report…”.
After sending
- The pane shows PhishTrainer's response.
- If the email was a simulation exercise organized by your company, the pane indicates this with the label “Phishing simulation spotted”.
- If you ticked “I entered a password or personal information” or “I opened an attachment”, a “Do this right away” box is shown:
- “Change the password you entered and tell your IT department.”
- “Tell your IT department: the attachment you opened may have infected your computer.”
- Deleting the email: depending on your organization's choice, the email is moved automatically to your Deleted Items (from where it can still be recovered), or the pane tells you “You can now delete this email.”
- If you report the same email twice, PhishTrainer recognizes it as already reported.
First use
- A Microsoft sign-in or permission window may open: sign in with your usual work account. You do not need any PhishTrainer account or password.
- If the pane shows “Your organization is not yet linked to PhishTrainer. Enter the activation code provided by your administrator.”, enter the code received from your IT department in the Activation code field, then click Activate. Your account is then recognized on all your devices, with nothing more to enter.
Possible messages and what to do
| Message shown | What to do |
|---|---|
| “Select an email to be able to report it.” | Open the email to report, then click Report again. |
| “Email too large” | PhishTrainer accepts emails up to 3 MB, including attachments. If the Send without attachments button is offered, use it: the message will be analyzed, but not the attached files. Otherwise, forward the email to your IT department. |
| “Activation code rejected. Check it with your administrator.” | Check the code with your IT department. |
| “The report could not be sent” or “The reporting service cannot be reached” | Check your connection, then click Try again. If the problem persists, contact your IT department. |
| “Unable to connect to Microsoft” | Click Try again. If the problem persists, contact your IT department. |
| “Too many requests in a short time” | Try again in a few minutes. |
| “Your company must allow PhishTrainer. Forward this message to your IT department.” | Forward this message to your IT department. |
| “The reporting service is disabled for your organization…” | Contact your IT department. |
| “Your access has been removed…” | Contact your IT department. |
| “The report cannot be recorded at the moment…” | Contact your IT department. |
Privacy
The reported email is sent in full, including attachments, to PhishTrainer for analysis by your organization's security team. The About link, at the bottom of the pane, repeats this information and the add-in version.
Didn’t find the answer? Contact us