Phishing Reporting and Mailbox-Rule Checks

Published October 23, 2026 · Last reviewed October 23, 2026

Part 1: Reporting that people actually use

Staff report what is easy to report and what gets an answer. Put a report button in the mail client, name one person or mailbox to receive reports, and reply to every report within a working day, even if only to say thanks. A one-line reply is worth more than a training session, because it shows reporting is welcome.

Action

Enable the built-in report button. In Microsoft 365 the report button for Outlook is turned on in the Microsoft Defender portal under user reported settings, and reports can be routed to a mailbox you choose. In Google Workspace, users can use “Report phishing” from the message menu in Gmail. Menu names move between plans; search the admin console for “user reported”. Profile A Profile B/C delta: in Gmail the button is already present; your task is to name who reads the reports.

Why it helps

A button removes the choice between deleting the message and forwarding it as an attachment, which loses the headers an investigator needs.

Verification

Report a harmless test message and confirm it appears in the reports mailbox or queue within a few minutes.

Fallback if delayed

Publish one address, such as phish@your-domain, and ask staff to forward suspicious mail as an attachment.

Action

Agree what happens next. Write three lines: who reads reports, what they do if the message is real (block the sender, search for and remove copies, check whether anyone clicked), and how they tell the reporter.

Why it helps

A report with no response trains staff to stop reporting.

Verification

Time one test report from submission to reply. Aim for the same working day.

Fallback if delayed

Give the owner a calendar reminder to read reports daily until a deputy is named.

Part 2: The weekly mailbox-rule check

When an attacker signs in to a mailbox they often create rules to forward copies to an outside address, to move messages from a supplier or the bank into a rarely visited folder, or to delete replies to their own fraudulent messages. The rule runs quietly after the password is changed, which is why it is a key check after any suspected takeover.

Action

List inbox rules for the high-value mailboxes (owner, finance, payroll, executive assistants). Users can see their own under Outlook rules or the Gmail Filters and Blocked Addresses and Forwarding tabs. In Exchange Online an administrator can run Get-InboxRule -Mailbox name@example.com in PowerShell, and look at the forwarding, redirect and delete settings of each rule.

Why it helps

A rule that forwards externally, redirects or deletes mail is rarely created by the mailbox owner. Finding one is a strong sign the mailbox was compromised.

Verification

For each rule you did not recognise, ask the owner. Any rule that forwards outside the company, or moves bank or supplier mail to a hidden folder, should be treated as an incident.

Fallback if delayed

If you cannot use PowerShell, ask each of these users to read out their rules in a five-minute call.

Action

Block automatic external forwarding in the organisation. In Microsoft 365 this is the outbound spam policy’s automatic forwarding setting; in Google Workspace look at the Gmail auto-forwarding settings in the Admin console. Allow exceptions by name only.

Why it helps

If automatic external forwarding is off, a hidden forwarding rule cannot send your mail out of the company.

Verification

Create a test rule in a test mailbox that forwards to a personal address, send it a message, and confirm the message is not delivered externally.

Fallback if delayed

Alert on new forwarding rules and review them daily if blocking cannot be done yet.

If you find a bad rule

Do not just delete it. Reset the password, revoke active sessions (see session and token control), check sign-in history for the date the rule appeared, and review what was sent or forwarded. Then tell the people who emailed that mailbox since that date, and report the incident as set out in the first-hour plan.

Common failure mode

Resetting the password and stopping there. The rule, the delegated access and the connected apps remain, so the attacker keeps seeing the mailbox after the reset. A second failure is restricting the check to user-visible rules: some rules are hidden from the normal rules screen, which is why an administrator-level listing is needed.

How it works

An inbox rule is just a stored instruction that the mail server applies to each arriving message. Because the server applies it, the rule continues to work whether or not the attacker is still signed in. That is why rules, delegated access and app permissions are the three things to check after any password reset: they are the ways an attacker keeps access without a password.

Reporting works as an early-warning loop. The first employee to see a phishing campaign often reports it within minutes; if the report triggers a search-and-remove across all mailboxes, the other recipients never see it. That depends on the report reaching a person quickly, which is why the response step matters as much as the button. Microsoft documents how reported messages are handled and how to respond to a compromised account, linked below.

Worked example

Suppose, as a hypothetical, an accounts clerk reports an odd message. The reader of the reports mailbox finds that three colleagues received it and that one clicked. A search removes the message from all mailboxes within the hour, and the colleague who clicked is asked to reset the password and sign out of all sessions.

The following Friday the weekly rule check on the finance mailbox finds a rule named with only a full stop that moves any message containing “invoice” to the Archive folder. Nobody on the team created it. The administrator removes it, resets credentials, reviews sign-ins and starts the incident steps. All details are invented for illustration, but the order of events is typical: a quiet rule found by a routine check rather than by a loss.