Help For employees
Report a suspicious email in Outlook for Windows
The PhishTrainer button icon in your mailbox
On this page
What the PhishTrainer buttons are for
The “PhishTrainer by Bexxo” group in Outlook sends a suspicious email to your organization's security team. Use it as soon as you receive an email that looks doubtful to you.
| Button | Use |
|---|---|
| Report as phishing | Fraudulent email trying to trick you (link, attachment, request for credentials or payment). |
| Report as spam | Unsolicited advertising or mass email, with no intent to trick you. |
| Settings | Connect PhishTrainer to your organization, check the connection, choose the language. |
| About | Version, publisher, updates and support information. |
When in doubt, report it as phishing: your security team will check it.
Before reporting: do not click any link, do not open any attachment, do not forward the email and do not reply to it.
Where to find the buttons
- In the main Outlook window: Home tab, “PhishTrainer by Bexxo” group.
- In an email opened in its own window: same group, in the ribbon of that window.
- By right-clicking an email: “PhishTrainer by Bexxo” menu, with the two reporting buttons only.
Hover over a button to show its explanation.
Reporting an email, step by step
- Select the suspicious email in the list, or open it. The email must have been received (not a draft).
- Click Report as phishing or Report as spam. The “Report this email” window opens, with the type matching the button already chosen:
- Phishing: a fraudulent email trying to trick you
- Spam: unsolicited advertising or bulk email
- For the question “Did you interact with this email?”, tick what you did, otherwise leave blank:
- I clicked a link
- I opened an attachment
- I entered a password or personal information
- I replied or called the number given
- Click Send report (or Cancel to give up). The “Sending report…” window is shown while sending.
A connection to the PhishTrainer server is required: without a network, the report is not queued. Do it again once the connection is back.
Large email
If the email is larger than 3 MB with its attachments, the “Large email with attachments” window offers Send without attachments: the sender, the headers and the text are sent, without the attached files. Your email, in Outlook, is not modified. Above 10 MB, the email cannot be reported: forward it to your IT department.
Reporting several emails at once
- Select up to 20 emails in the list, then click a reporting button.
- Confirm: the “Report n emails?” window indicates that the emails will be sent one by one. They are all reported with the same type (phishing or spam).
- If some emails are larger than 3 MB with their attachments, a single question is asked for all of them: Send without attachments or Skip these emails.
- At the end, a summary shows the number of reports sent, the simulation exercises spotted, and the emails not reported (drafts, encrypted emails, items that are not emails, or emails that are too large) or not sent.
For a batch report, the question “Did you interact with this email?” is not asked. If you clicked a link or opened an attachment in one of these emails, report it on its own.
After sending
- A window shows PhishTrainer's response, or otherwise “Thank you, your report has been sent.”
- If the email was a PhishTrainer simulation exercise organized by your company, the window congratulates you.
- If you ticked “I entered a password or personal information” or “I opened an attachment”, a “Do this right away” box is shown:
- “Change the password you entered and tell your IT department.”
- “Tell your IT department: the attachment you opened may have infected your computer.”
- Deleting the email: depending on your organization's choice, the reported email is moved to your Deleted Items, from where it can still be recovered.
First use: activate PhishTrainer
Usually, your IT department activates PhishTrainer for you. If it has not, clicking a reporting button opens the “Discover PhishTrainer” window, which explains the difference between phishing and spam. Click Set up now, or open Settings, then:
- Get the activation code from your PhishTrainer administrator or your IT department.
- Copy the full code: it starts with
sig_vsto_. - In the “Connect PhishTrainer to your organization” section, paste it into the field (Paste button), then click Activate.
- The message “PhishTrainer is connected to your organization: you can now report suspicious emails.” confirms the activation, and the connection status changes to Connected.
If the window shows “The connection is managed by your IT department: no action is needed on your part.”, you have nothing to enter.
New mailbox in Outlook
If you add a mailbox to Outlook after activation, its emails cannot be reported until it is connected. Outlook then shows “New mailbox in Outlook”: click Connect now if this button is offered; otherwise, open the settings and activate PhishTrainer again with the activation code.
Settings and About
- Connection status: Connected, Not set up, Connecting…, Set up, server unreachable or Access removed, with the name of the organization and the date of the last synchronization. Sync now restarts the connection.
- Language: French, German, Italian or English. In “Automatic (Outlook language)” mode, PhishTrainer follows the Outlook language and is shown in English if that language is not available.
- Updates: an orange badge on About indicates a new version. Installing requires administrator rights: your IT department can take care of it.
- Support: in About, Copy diagnostic information copies the useful information (without the activation code). Paste it into your support request.
Possible messages and what to do
| Message shown | What to do |
|---|---|
| “Select the email to report.” or “Only emails can be reported.” | Select an email, then click the button again. |
| “This email has not been received (draft or unsent email): it cannot be reported.” | Only received emails can be reported. |
| “This email is encrypted or protected: it cannot be analyzed. Please contact your IT department.” | Forward the email to your IT department. |
| “This email is too large (over 10 MB) and cannot be reported. Contact your IT department.” | Forward the email to your IT department. |
| “This email is in a mailbox that is not yet connected to PhishTrainer on this computer…” | Connect the mailbox (see “New mailbox in Outlook”). |
| “Select at most 20 emails at a time.” | Reduce the selection. |
| “A report is already being sent. Please wait a moment.” | Wait for the current sending to finish. |
| “PhishTrainer is starting. Try again in a few seconds.” | Try again a little later. |
| “PhishTrainer is not set up yet. Open the settings to connect it to your organization.” | Activate PhishTrainer (see “First use”). |
| “The add-in activation is no longer valid…” | Click Open settings and paste the activation code again. |
| “This activation code is not valid. Check that it is complete.” or “The server rejected this activation code. Contact your IT department.” | Check the code with your IT department. |
| “The PhishTrainer server is unreachable. Please try again later.” or “The report could not be sent…” | Check your connection and try again. If the problem persists, contact your IT department. |
| “Too many requests in a short time. Try again in a few minutes.” | Try again in a few minutes. |
| “The reporting service is disabled for your organization…” | Contact your IT department. |
| “Your access has been withdrawn. Contact your IT department.” | Contact your IT department. |
| “Server address not secure” | Contact your IT department: no report is sent until this is corrected. |
Privacy
The reported email is sent in full (including attachments, unless you choose to send it without them) to PhishTrainer, for analysis by your organization's security team, with the boxes you ticked. You have no PhishTrainer account or password.
Didn’t find the answer? Contact us