Reported Emails: Review What Your Staff Report

When someone in your organisation reports a suspicious e-mail, it lands in Phishing → Reported Emails. Here you can see both reported simulations and real, external e-mails – so you know whether your people recognise phishing and whether a real attack might be under way.

How reports arrive

Your staff can report a suspicious e-mail in two ways:

• Forward it to the report address – see "How to report suspicious mails".
• Use the Outlook add-in – one click in Outlook, no forwarding needed.

If your organisation already uses a report button from another e-mail security vendor, it can forward reports to AutoPhish too – see "Connect existing Report Phishing buttons to AutoPhish".

AutoPhish recognises its own simulations automatically and links the report to the right campaign. Forwarded external e-mails are assigned to your company via your verified domains.

The Reported Emails page

Open Phishing → Reported Emails. The page shows the number of reports and a list on the left; select a report to see its details on the right.

Use the tabs to filter the list:

Report details

For each report you see when it was reported, the source (forwarded or Outlook add-in), subject, type (AutoPhish Simulation or External Email), sender and recipient, and – for simulations – the campaign. Below that, Raw Email Content shows the original message, including its headers.

Admins can download the complete original e-mail as an .eml file if it is larger than the preview, for example to pass it on to your IT service provider or security team.

What to do with an external report

1. Check the sender, the links and the headers in Raw Email Content. Do not click any links or open attachments.
2. If it is phishing, warn your staff, block the sender or domain in your e-mail security and check whether anyone else received it.
3. Keep the report, and ask your staff to keep the original message too – both are evidence for the analysis.

Reports can be deleted by admins, but we recommend keeping them so you can trace incidents later.

How reports count in your results

• Reported simulations are counted in Phishing → Reports and on the Dashboard as Reported, with a report rate.
• Reporting a simulation lowers the risk figures – reporting is exactly the behaviour you want to strengthen.

Notifications

Company admins receive a daily e-mail summary of the previous day's reports, with a button to open this page. It is controlled by Security notifications under Settings → Account – see "Notification Settings: E-Mails for Admins".

Who can see reports

All members of your company can view the list and details. Only admins can download full e-mails or delete reports. Reported e-mails are shown in full, also when Anonymous Mode is enabled – the pseudonymised view applies to reports and statistics in Phishing → Reports.

Updated on: 28/10/2026