What to Do With a Suspicious Message Instead of Forwarding It

Pause before interacting

Do not click a link, open an attachment, reply, or use contact details supplied in the message to verify it. Those actions can expose you to risk or give a sender a response. A familiar display name is not enough to establish who sent a message.

If you are unsure, leave the message unopened while you decide what to do. You do not need to investigate its contents to make a cautious choice. Avoid copying its link into a chat or pasting it into another service; that still spreads potentially harmful material.

Use your organization’s route, if it has one

At work, check the guidance your organization has provided for suspicious messages. Depending on that guidance, you may be asked to use a designated reporting method or contact a particular support or security team. Follow the instructions you have actually been given; there is no single reporting feature or process that applies to every mailbox.

Keep the message intact if your organization’s process asks you to submit it. Do not add recipients or send it through a regular group email unless instructed. If the directions are unclear, ask through a known internal channel rather than replying to the suspicious sender.

Warn people without passing on the lure

If coworkers or friends might receive the same message, warn them in a separate, trusted conversation. Describe the basic signs to look for, such as an unexpected request or an unfamiliar sender, without including the original link or attachment. Do not attach a screenshot if it displays a scannable code, link, private information, or other material people might act on.

For example, you could tell a coworker, “I received an unexpected message claiming to be about a shared document. Please be cautious if you receive one too, and use our usual reporting process.” This alerts them without distributing the suspicious content.

Safer warning:
“I received an unexpected document message. Please check it carefully and follow our usual reporting process if it reaches you.”

Avoid forwarding the original message or pasting its link into the warning.

When deleting is a reasonable choice

If you are handling a personal message, or your organization’s guidance says no report is needed, deleting it may be appropriate. This is especially practical when the message is plainly unwanted and you have not interacted with it. Do not delete it first if workplace instructions say to preserve or report it.

Deleting the message from your inbox does not establish that other recipients have not received it, and it does not undo a click or attachment opening. Treat deletion as one cleanup step, not as proof that a wider issue has been resolved.

If you already clicked or opened something

Do not forward the message as a way to explain what happened. Follow your organization’s instructions for reporting a possible interaction, if applicable, and describe what you did as clearly as you can. Use a known support channel rather than any phone number, reply address, or link in the message.

For a personal account, stop interacting with the message and consider whether you need help from the relevant service or a trusted technical support person. Avoid sending passwords or one-time codes in a message. The right response depends on what happened and the account or device involved.

Check that your next step is complete

Before moving on, confirm the action you chose: if you reported the message, check that you followed the stated instructions and received any expected confirmation. A confirmation only shows that your report was submitted; it does not prove the message was investigated or that everyone else is protected. If you were told to preserve the message, make sure you did not delete it.

If you chose deletion, check that the message is no longer in your inbox and review any other folder only if it is relevant to your normal mail routine. If you warned someone, make sure your warning did not include the suspicious link or attachment. When in doubt, ask through a trusted channel rather than circulating the message.

• Pause: no clicking, opening, replying, or forwarding.
• Work message: follow the reporting or preservation instructions you have been given.
• No report needed: delete when appropriate, and warn others separately if necessary.
• Confirm: check that your chosen action was completed without spreading the message.