What should employees do after they suspect a phishing email but before they interact with it?

What to do before you touch the message

The safest response is to stop interacting with the email immediately and treat it as a potential security event, not just a nuisance. Verify the request through a separate trusted channel, such as a known phone number or internal chat, because the message itself may be part of the deception. If you already see signs of credential entry, report that detail with urgency.

Good practice is to preserve the message for investigation while avoiding any action that could execute content or confirm the attacker has a live mailbox. If your organisation uses a report button or abuse mailbox, use it right away so security can assess whether the message is isolated or part of a broader campaign.

Why fast reporting matters for the rest of the organisation

Reporting is valuable because defenders can still contain a phishing attempt before it spreads through other inboxes, identity sessions, or shared systems. Early notice gives security teams time to remove the message, search for similar lures, and warn other users who may be targeted by the same campaign.

That is why the response should not end at personal caution. A report creates the evidence trail that supports mailbox investigation, user notification, and any downstream containment actions. Phishing Incident Response Playbook is useful here because it shows how triage, scoping, purge and credential response fit together after a suspicious message is reported.

When the message may already have reached your account

If you suspect the email was not only opened but may have exposed credentials, the response becomes broader than message reporting. Password change, session review, and access review matter because phishing often aims to capture an entry point that can be reused after the original message is gone. In practice, the question is not only whether the email was malicious, but whether it changed the trust state of the account.

That is also why a suspicious message should be handled as a possible precursor to account takeover, token theft, or further internal abuse. How to Spot a Phishing Email Guide helps users recognise the cues that justify escalation, while Social Engineering Guide explains why verification through a separate channel is so important when urgency or authority is being used to pressure a quick response.

Risk and Threat Considerations

Phishing is dangerous before a user clicks because the attacker is often trying to create a moment of trust, urgency or routine action that leads to credential capture or malware delivery. The main risk is not just the individual email, but the possibility that one user’s interaction becomes a foothold for wider access, impersonation, or repeated targeting.

Failure mechanism: The user trusts the message enough to follow links, open attachments, or respond through the attacker-controlled channel, which can expose credentials, tokens, or other sensitive access material.

Impact: An early mistake can turn a single suspicious email into account compromise, mailbox abuse, lateral targeting, or a broader incident that affects other employees and systems.

Practitioner Guidance

What to prioritise: Treat the first report as a containment opportunity, not just a user-support request. The priority is to stop interaction, preserve the message details, and route it to the team that can search for related deliveries, suspicious sign-ins, or repeated targeting.

Decision rule: If the message asked for credentials, payment, password reset, document access, or urgent verification, assume the risk is higher and escalate faster. If the user already typed anything into a linked page, begin with password reset and session review rather than waiting for confirmation that the email was malicious.

What practitioners underestimate: The value of reporting is often lost when users delete the email privately or wait to “make sure” it is bad. Fast internal reporting often matters more than perfect user certainty, because the defenders need time to contain the campaign while it is still active.

Practitioner takeaway: The best response is immediate non-interaction, separate-channel verification, and rapid reporting, because speed is what preserves both containment options and account recovery options.

Related resources from NHI Mgmt Group

• Guide: Phishing Guide
• Phishing Email
• What should people do after they suspect their email or social media account has been compromised?
• How should security teams stop HR-themed phishing before employees have to judge whether an email is legitimate?
• What should employees do after they click a suspicious link or open a phishing attachment?