Phishing in a Small Team: How to Recognize It and How to Report It

Phishing is a message sent in the name of a trusted person or organization, intended to get someone to open a harmful link or file, or to send personal and financial data. Besides email, it can also arrive as an SMS, a social media message, or even a phone call. For a small business, one thoughtless click is enough for the threat to affect the whole team. That is why below you will find simple, practical rules that every employee can use.

The first thing to remember: phishing emails are becoming more convincing. The US cybersecurity agency CISA notes that attackers may use specific personal or company details to make a fake message look genuine. A message can also come from an acquaintance's account if that account has been compromised. So the fact that the sender is familiar is not enough to conclude that the email is safe.

Which signs to watch for:

• An urgent or emotional tone, especially when the email threatens unpleasant consequences if we do not reply immediately
• A request for personal or financial information
• An unexpected request that does not look like the usual process
• Shortened or unfamiliar links
• A sender address that only resembles a real company but does not match it
• A link whose displayed text and actual address do not match
• An unknown attachment, or a request to download and open an attachment
• A generic greeting and a signature without contact details

In case of doubt, CISA recommends a few simple steps. On a computer, hover the mouse over the link without clicking it and see what address it leads to. If the email seems to come from an acquaintance, contact that person in the way you usually do, not through the phone number or address given in the email. Google's help page recommends the same: if after following a link you are asked for a password, do not enter it, and instead open the site you need directly. Google also writes that if you are already signed in to your account, an email from Google will not ask you for that account's password.

If an email looks like a Google security alert and you suspect it is fake, do not use the links in the email. Instead, open the security alerts page of your Google Account and check the recent activity there.

What to do if you have a suspicion:

• Do not click links and do not open attachments
• Verify the request in a trusted way, for example by phone
• Report the email using the built-in function of your email system
• Inform your IT person in charge
• Delete the email after reporting it

If you have already clicked a link and entered a password, CISA recommends changing your passwords immediately. It is best to do this from a clean, trusted device, and to change the same password in other services too if it is used there as well.

How to report in Outlook. According to Microsoft Learn, supported versions of Outlook have a built-in Report button. Select one or more emails, click Report, and then choose Report phishing or Report junk from the drop-down list. An email reported as phishing is removed from the mailbox, while a junk email is moved to the Junk Email folder. Where the report is sent depends on your organization's settings: it may go to a mailbox specified by the organization, to Microsoft, or to both. If a legitimate email accidentally ended up in Junk Email, you can choose Not junk with the same button.

How to report in Gmail. On a computer, open the email, click the three-dot menu (More), choose Report phishing and confirm. If an email was marked as phishing by mistake, the same menu has Report not phishing. If the Google Workspace administrator in your organization has set up additional tools, use those as well.

Why reporting matters, and not just deleting. CISA's joint recommendations confirm that reporting phishing is one of the most effective ways to protect organizations, because it helps email providers detect new or growing attacks. Deleting protects only your own mailbox, while reporting gives the IT person in charge the opportunity to warn other employees or take the necessary measures.

For a small team, several organizational steps are worth taking:

• Appoint a person or a place where people should turn in case of doubt
• Every employee should know whom to tell and how. CISA emphasizes that this knowledge should be repeated regularly in the team
• Training should not be a one-time event. According to CISA, one briefing per year is not enough
• Enable SPF, DKIM and DMARC for your domain. According to the joint recommendations of CISA, NSA, FBI and MS-ISAC, these mechanisms help verify the sending server for received emails
• Use two-step sign-in. CISA recommends phishing-resistant multi-factor authentication wherever possible

The main rule is simple: stop, verify, report. If an employee is not afraid of being blamed for a mistake, they will report a suspicious email faster, and this is often decisive.

If you want phishing reporting settings, email protection and two-step sign-in to be set up correctly in Microsoft 365 or Google Workspace, the Appy.ge team will be happy to help. Appy is an official Microsoft CSP partner, and we also set up Google Workspace.

Sources:
• Teach Employees to Avoid Phishing - CISA - https://www.cisa.gov/audiences/small-and-medium-businesses/secure-your-business/teach-employees-avoid-phishing
• Recognize and Report Phishing - CISA - https://www.cisa.gov/secure-our-world/recognize-and-report-phishing
• Report phishing and suspicious emails in Outlook for admins - Microsoft Learn - https://learn.microsoft.com/en-ZA/defender-office-365/submissions-outlook-report-messages
• Avoid & report phishing emails - Gmail Help - https://support.google.com/mail/answer/8253?hl=en
• Phishing Guidance: Stopping the Attack Cycle at Phase One - CISA - https://www.cisa.gov/sites/default/files/2025-03/Phishing%20Guidance%20-%20Stopping%20the%20Attack%20Cycle%20at%20Phase%20One%20508.pdf