> ## Knowledge Base Index
> Fetch the complete knowledge base index at: https://help.autophish.io/sitemap.xml
> Use this file to discover available pages before exploring further.
> Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash).

# Reported Emails: Review What Your Staff Report

When someone in your organisation reports a suspicious e-mail, it lands in **Phishing → Reported Emails**. Here you can see both reported simulations and real, external e-mails – so you know whether your people recognise phishing and whether a real attack might be under way.

## How reports arrive

Your staff can report a suspicious e-mail in two ways:

- **Forward it to the report address** – see "How to report suspicious mails".
- **Use the Outlook add-in** – one click in Outlook, no forwarding needed.

If your organisation already uses a report button from another e-mail security vendor, it can forward reports to AutoPhish too – see "Connect existing Report Phishing buttons to AutoPhish".

AutoPhish recognises its own simulations automatically and links the report to the right campaign. Forwarded external e-mails are assigned to your company via your verified domains.

## The Reported Emails page

Open **Phishing → Reported Emails**. The page shows the number of reports and a list on the left; select a report to see its details on the right.

![Reported Emails page with the All, AutoPhish Emails and External Emails tabs](https://storage.crisp.chat/users/helpdesk/website/-/4/3/7/4/437439cedb096800/reported-emails_yb4kl3.jpg)

Use the tabs to filter the list:

| Tab | Shows |
| ---- | ---- |
| **All** | Every report for your company |
| **AutoPhish Emails** | Reported simulations – the behaviour you want to see |
| **External Emails** | Real e-mails that were reported – check these first |

## Report details

For each report you see when it was reported, the source (forwarded or Outlook add-in), subject, type (**AutoPhish Simulation** or **External Email**), sender and recipient, and – for simulations – the campaign. Below that, **Raw Email Content** shows the original message, including its headers.

Admins can download the complete original e-mail as an `.eml` file if it is larger than the preview, for example to pass it on to your IT service provider or security team.

## What to do with an external report

1. Check the sender, the links and the headers in **Raw Email Content**. Do not click any links or open attachments.
2. If it is phishing, warn your staff, block the sender or domain in your e-mail security and check whether anyone else received it.
3. Keep the report, and ask your staff to keep the original message too – both are evidence for the analysis.

Reports can be deleted by admins, but we recommend keeping them so you can trace incidents later.

## How reports count in your results

- Reported simulations are counted in **Phishing → Reports** and on the Dashboard as **Reported**, with a report rate.
- Reporting a simulation lowers the risk figures – reporting is exactly the behaviour you want to strengthen.

## Notifications

Company admins receive a daily e-mail summary of the previous day's reports, with a button to open this page. It is controlled by **Security notifications** under **Settings → Account** – see "Notification Settings: E-Mails for Admins".

## Who can see reports

All members of your company can view the list and details. Only admins can download full e-mails or delete reports. Reported e-mails are shown in full, also when Anonymous Mode is enabled – the pseudonymised view applies to reports and statistics in **Phishing → Reports**.