Information:

Unexpected payroll document?

Pause before opening an unexpected document or signing in through a message. Use the company’s approved reporting feature or a security contact you already know.

A message worth checking

Fictional example — there is no working link in this sample.

“I have shared an updated payroll document with you. Open the document and sign in to check your details today.”

You were not expecting a payroll document from this colleague. The unexpected request and sign-in prompt are reasons to pause; the sender’s familiar name alone does not establish that it is safe.

Three actions to take

Use the approved security reporting route for your organization.

  1. 1

    Pause

    While you are unsure, do not reply, click links, or open attachments. Do not sign in through a link in the message.
  2. 2

    Report and preserve context

    Use your organization’s approved reporting feature or contact a known security contact. Include the message and relevant details through that route; do not forward it through an unapproved channel.
  3. 3

    Follow the security team’s instructions

    After reporting, use the guidance provided by the security team. If they need more information, share it through the approved route.

What to include in your report

Share enough detail for the security team to identify the message and understand what happened. Do not include passwords, sign-in codes, or other secrets.

Message details

Example: “I received a message today claiming to be from a colleague. It asked me to open an unexpected shared payroll document and sign in.”

  • When it arrived, including the time if known
  • The sender name and address as shown in the message
  • The subject line and what the message asked you to do
What you did

State plainly whether you did not interact, clicked a link, opened an attachment, or entered sign-in information.

  • Describe the action you took, if any
  • Say whether you entered information, without repeating passwords or codes
  • Mention any unexpected page or prompt you saw

If you already interacted

Report promptly and use the security team’s handoff.

If you clicked the link, opened the attachment, or entered sign-in information, report what happened promptly through the approved security reporting feature or a known security contact. Include which action occurred and when, if known. Do not send passwords or sign-in codes in the report.

Follow the security team’s instructions for what to do next. If you are unsure how to reach them, use your organization’s established security reporting route rather than an unverified address or link.