Report a Suspicious Message
A mobile-friendly intranet page showing employees how to pause, report a suspicious message through an approved security route, and share useful context without exposing passwords or sign-in codes.
Every employee gets a seat — priced per employee in Communications & Intranet, quoted with this template ready.
Rolled out to every employee at AutoZone (125,000), PetSmart (50,000+), A.S. Watson and Raley's (20,000) — and at larger retailers we are not permitted to name.
Built for: Financial services · Healthcare · Education · Government
Overview
Report a Suspicious Message is a short intranet reference for employees who receive an unexpected message and need to know what to do next. Its fictional example describes a purported shared payroll document that asks the recipient to sign in. The page makes the central caution explicit: a familiar sender name does not prove a message is safe.
The content moves from an immediate pause notice to three actions: avoid interacting while uncertain, report through the organization’s approved feature or a known security contact, and follow the security team’s instructions. A two-column section helps employees provide useful context, including the message’s arrival time, displayed sender, subject, requested action, and any interaction. It warns them not to include passwords or sign-in codes. A final section covers the important edge case of someone who already clicked, opened an attachment, or entered information, directing them to report promptly.
Use this page as a concise, mobile-friendly help reference linked from a security knowledge base, employee help hub, or relevant awareness page. Before publishing, confirm the organization’s real reporting route and ensure the security team agrees with the handoff language. This template does not include a working reporting link, incident intake form, live security feed, or technical recovery instructions. It is not a substitute for an incident-response policy, a tailored procedure for a specific threat, or a training program; link to authoritative local guidance where those are needed.
Standards & compliance context
- Treat this page as general employee guidance, not evidence that the organization meets a particular security law, regulation, or incident-reporting deadline.
- Have the security and compliance owners confirm that the reporting route and handoff language align with applicable organizational policies before publication.
- Keep passwords and sign-in codes out of the report, as the page explicitly instructs, and avoid adding forms that collect secrets.
- Check headings, reading order, contrast, and keyboard access against WCAG 2.1 AA when publishing the page, including any reporting links added locally.
General regulatory context for orientation only — verify current requirements with counsel or the relevant agency before relying on this template for compliance.
What's inside this template
Unexpected payroll document?
Start with the immediate pause instruction before interacting with an unexpected document or sign-in request.
-
Pause before opening an unexpected document or signing in through a message. Use the company’s approved reporting feature or a security contact you already know.
A message worth checking
This clearly fictional example shows why an unexpected request deserves caution even when the sender name looks familiar.
-
Fictional example — there is no working link in this sample. “I have shared an updated payroll document with you. Open the document and sign in to check your details today.” You were not expecting a payroll document from this colleague. The unexpected request and sign-in prompt are reasons to pause; the sender’s familiar name alone does not establish that it is safe.
Three actions to take
Follow these actions in order, using the reporting route approved by your organization.
-
Use the approved security reporting route for your organization. Pause While you are unsure, do not reply, click links, or open attachments. Do not sign in through a link in the message. Report and preserve context Use your organization’s approved reporting feature or contact a known security contact. Include the message and relevant details through that route; do not forward it through an unapproved channel. Follow the security team’s instructions After reporting, use the guidance provided by the security team. If they need more information, share it through the approved route.
What to include in your report
Share the message details and what happened so the security team can identify the issue without receiving secrets.
-
Share enough detail for the security team to identify the message and understand what happened. Do not include passwords, sign-in codes, or other secrets. Message details Example: “I received a message today claiming to be from a colleague. It asked me to open an unexpected shared payroll document and sign in.” When it arrived, including the time if known The sender name and address as shown in the message The subject line and what the message asked you to do What you did State plainly whether you did not interact, clicked a link, opened an attachment, or entered sign-in information. Describe the action you took, if any Say whether you entered information, without repeating passwords or codes Mention any unexpected page or prompt you saw
If you already interacted
If you clicked, opened an attachment, or entered information, report the action promptly and follow the security team’s handoff.
-
Report promptly and use the security team’s handoff. If you clicked the link, opened the attachment, or entered sign-in information, report what happened promptly through the approved security reporting feature or a known security contact. Include which action occurred and when, if known. Do not send passwords or sign-in codes in the report. Follow the security team’s instructions for what to do next. If you are unsure how to reach them, use your organization’s established security reporting route rather than an unverified address or link.
How to use this template
- Confirm with the security owner which reporting feature or known-contact route employees should use, and identify the authoritative intranet destination if one exists.
- Adapt the fictional payroll-document example to a realistic, non-sensitive scenario for your organization while preserving its fictional status and the warning not to trust a familiar sender name alone.
- Publish the page in the security knowledge base or employee help area and link to it from relevant security guidance using a real, verified destination.
- Ask the security owner to check that the reporting instructions, information to include, and already-interacted handoff match current organizational practice.
- Tell employees to use the guidance when a message seems unexpected, and to report promptly through the approved route if they have already interacted.
- Review the page whenever the reporting route, security contact process, or response instructions change, and correct or remove outdated guidance.
Best practices
- Put the approved reporting route where employees can find it quickly, and verify the destination before publishing any link.
- Keep the fictional payroll example clearly labeled so readers do not mistake it for a real incident report.
- Preserve the instruction not to reply, click links, open attachments, or sign in through a message while its safety is uncertain.
- Ask employees to report what they did and when, if known, without repeating passwords, sign-in codes, or other secrets.
- Use a known security contact or approved reporting feature rather than asking employees to forward suspicious messages through an unapproved channel.
- Keep the three actions and report-detail checklist readable on a phone, with short headings and scannable text.
- Name an accountable security-content owner and revisit the page when reporting routes or response instructions change.
What this template typically catches
Issues teams running this template most often surface in practice:
Common use cases
Frequently asked questions
What kinds of messages does this page help employees report?
It is written around an unexpected shared payroll document that asks the reader to sign in. The same pause-and-report guidance can help with other unexpected messages that contain links, attachments, or requests for sensitive information. Adapt the example to match the threats and reporting instructions your organization actually uses.
Who should own and maintain this page?
The security team or the role responsible for employee security guidance should own its accuracy. That owner should confirm the approved reporting feature and known security contact route before publishing. Review the page whenever those routes or the team’s instructions change.
How often should employees use the reporting guidance?
Employees can use it whenever a message seems unexpected or asks them to take an unusual action. The page does not prescribe a reporting cadence or replace your organization’s incident-response process. If someone has already clicked, opened an attachment, or entered sign-in information, the page says to report promptly.
Does this template meet a specific legal or regulatory requirement?
It is practical employee guidance, not a compliance certification or a substitute for your incident-response policy. The template does not identify a jurisdiction, regulatory framework, or mandatory reporting deadline. Ask your security and compliance owners to confirm any organization-specific requirements before publishing.
What should employees include in a report, and what should they leave out?
The page prompts employees to share when the message arrived, the sender details as displayed, its subject and request, and what they did. It explicitly says not to include passwords or sign-in codes. Employees should submit the message and context only through the organization’s approved route, not an unapproved forwarding channel.
What should someone do if they already clicked or entered information?
The page directs them to report promptly through the approved security reporting feature or a known security contact. They should describe what action occurred and when, if known, without sending passwords or codes. The security team’s instructions are the next handoff; the template does not invent technical remediation steps.
What must we customize before publishing this page?
Replace the fictional payroll-message example if a different example better fits your workforce, and name or link only to reporting routes your organization has confirmed. Add a real destination using your intranet’s supported page-link setup if you have an authoritative reporting guide. Do not leave readers with an invented address or a nonworking sample link.
How is this better than an ad hoc security reminder?
The page puts the immediate action first, then gives a three-step response, a structured list of report details, and a separate path for people who already interacted. That makes the handoff clearer than a reminder that only says to be careful. It still depends on the organization providing a real, approved reporting route.
Related templates
Go deeper on the topic
-
A modern intranet is a specific surface — typically the home-base destination where employees get company news, find policies, and access key apps. A digital...
-
Compare clinical communication platforms and workforce apps for hospitals. Learn how to reach frontline healthcare staff without EHR logins in 2026.
-
See how automated credential checks, labor rules, and real-time coverage tracking give charge nurses a schedule they can trust before every shift.
-
Clinical Staff Engagement with MangoApps: unify schedules, training, and HR self-service in one mobile app for frontline healthcare teams.
-
Healthcare employee engagement ideas to reduce burnout, boost retention, and improve patient outcomes in your health system.
Ready to use this template?
Every employee gets a seat. Request pricing for Communications & Intranet and we quote into a workspace with Report a Suspicious Message ready.
Rolled out to every employee at AutoZone (125,000), PetSmart (50,000+), A.S. Watson and Raley's (20,000) — and at larger retailers we are not permitted to name.
