What should employees do after they suspect a phishing email but before they interact with it?

Pause, Verify, and Report Before You Interact

The safest next step is to stop interacting with the message and treat it as potentially hostile until proven otherwise. A separate trusted channel, such as a known phone number or internal chat that is not linked from the email, is the right way to confirm whether the request is real. Immediate reporting matters because it preserves evidence and lets security teams contain the message before others respond to it.

One practical habit is to assume the first visible detail may be the attacker’s hook, not proof of legitimacy. Link text, sender display names, reply-to tricks, and attachment names can all be manipulated to create urgency. If the message reached a shared mailbox, distribution list, or business process, the reporting step should happen even faster because the blast radius is larger.

What to Do If You Already Exposed a Secret

If the message was only suspected, the response is simple: do not click, do not open, and do not reply. If an employee already entered a password, opened a file, or approved a prompt for authentication, the situation changes from suspicion to potential compromise. At that point, password reset, session review, and account access review become time-sensitive actions rather than optional cleanup.

Fast containment is more important than trying to prove with certainty whether the email was malicious first. Security teams can inspect headers, quarantine similar messages, search for recipients, and look for follow-on activity, but employees should not wait for that analysis before reporting. The earlier the alert, the more likely defenders can stop token theft, mailbox rules abuse, or lateral phishing before it spreads.

Why Trusted-Channel Verification Is the Deciding Step

Trusted-channel verification is the control that breaks the attacker’s control over the conversation. A phishing email often tries to move the victim into the attacker’s preferred channel, such as a fake login page, a malicious document, or a fraudulent payment workflow. Verifying through a known-good route preserves decision quality because it avoids using the compromised message itself as the source of truth.

That verification should be specific, not casual. Employees should confirm the request with the named requester, the help desk, or the business owner using contact details already stored in an approved directory or internal portal. If the message claims urgency, payment, credential reset, or document review, the urgency itself is a warning sign, not a reason to accelerate interaction.

Risk and Threat Considerations

Phishing is dangerous because a single interaction can create immediate exposure through credential theft, session hijacking, or malicious code execution. Even when the first click does not fully compromise the account, it can give defenders too little time to stop inbox rules, token replay, or secondary delivery to colleagues.

Failure mechanism: The attacker relies on the employee to move from suspicion to interaction before verification happens, then uses the resulting trust step to capture credentials, tokens, or malware execution.

Impact: The organization can face account takeover, unauthorized access to mail or business systems, and wider internal spread if the same lure is forwarded or reused.

Practitioner Guidance

What to verify: Train employees to verify the request itself, not just the sender name. The key question is whether the business action is expected by the real requester, not whether the email looks polished or comes from a familiar brand.

Decision rule: If there is any doubt and the message asks for credentials, payment, document review, or urgent action, report first and verify later through a trusted channel. If a password or MFA step may already have been exposed, treat it as a potential incident and move immediately to account protection and access review.

Practitioner takeaway: The critical control is not recognizing every phishing pattern, it is preventing a suspicious message from becoming an authenticated interaction before defenders can intervene.

Related resources from NHI Mgmt Group

• What should people do after they suspect their email or social media account has been compromised?
• How should security teams stop HR-themed phishing before employees have to judge whether an email is legitimate?
• Why does identity matter more when vulnerabilities are discovered faster than they can be patched?
• Why do attackers often check model availability before trying to generate content?