A reported email is not automatically an incident, but it is always a useful security signal. Knowing how to investigate reported phishing quickly and consistently determines whether a malicious message is contained before it reaches more users, or becomes an account compromise, payment fraud event or data breach. For organisations running Microsoft 365, the investigation must also lead to a clear remediation decision across the wider mail estate.
Start with triage, not assumptions
The first task is to establish what has been reported and why. Employees may report obvious credential-harvesting emails, but they will also report legitimate messages that look unusual, marketing emails, internal test campaigns and routine spam. Treating every report as malicious wastes analyst time. Treating every report as harmless creates exposure.
Capture the original message in its unaltered form, including the full headers, attachments, embedded URLs, reporting user and time of delivery. Avoid relying on a screenshot alone. Screenshots can help explain what the employee saw, but they do not provide the routing, authentication and message-identification data needed to investigate reliably.
A sensible triage process should answer three immediate questions: is the message malicious or suspicious, did it reach other recipients, and has anyone interacted with it? These questions set the priority. A credential theft email delivered to one person who has not clicked is different from a finance-themed impersonation email delivered to hundreds of users shortly before a payment run.
How to investigate reported phishing step by step
Confirm the sender and delivery path
Start with the envelope sender, visible From address, Reply-To address and Return-Path. Phishing messages frequently use lookalike domains, display-name impersonation, compromised supplier accounts or unrelated Reply-To addresses. A familiar display name is not evidence that the sender is legitimate.
Review the message headers to assess the route taken into Microsoft 365 and the results of SPF, DKIM and DMARC checks. Authentication failures can be significant, but they are not a verdict on their own. Legitimate services can be misconfigured, while sophisticated phishing may originate from a compromised, correctly authenticated mailbox or trusted third-party platform.
Compare the sending domain with known supplier domains, internal naming conventions and previous correspondence. Pay close attention to small substitutions, extra words, unusual top-level domains and internationalised domain characters. Where a message claims to be from a known contact, independently verify the request through an established channel rather than replying to the email.
Examine the content, URLs and attachments safely
Read the message as the recipient would. Identify the claimed purpose, requested action, urgency, authority cues and any deviation from normal business process. Common indicators include password expiry notices, shared-document alerts, invoice queries, payroll changes, QR codes and requests to bypass approval controls. The strongest evidence is often the combination of signals rather than one obvious flaw.
Extract and inspect every URL without opening it in a production browser. Check the displayed text against the actual destination, redirects, domain age and reputation where your approved tooling supports this. Analyse whether the page is designed to collect Microsoft 365 credentials, multi-factor authentication codes, payment details or personal data.
Attachments require the same discipline. Determine the true file type, whether archives are password-protected, whether Office files contain macros or external links, and whether PDFs contain embedded URLs. Use an isolated analysis environment or approved detonation capability. Do not forward a suspicious attachment between analysts as a convenience, and do not allow it to be opened on an unmanaged endpoint.
Establish scope with message trace and search
A single user report may reveal a broader campaign. Use the message ID, sender address, subject, sending domain, URLs, attachment hashes and other indicators to search for related deliveries. In Microsoft 365, message trace and threat investigation capabilities can help establish recipient count, delivery status, filtering action and whether messages remain in mailboxes.
Scope should include forwarded copies and variants. Attackers commonly rotate subjects, sender addresses and URLs while retaining the same landing page, attachment family or social-engineering theme. Searching only for the exact subject line can leave active messages untouched.
Record the population affected: recipients, departments, privileged users, finance teams, shared mailboxes and external forwarding routes. A message delivered to a high-risk function may justify urgent containment even when the overall recipient count is low.
Check for user interaction and compromise
The investigation changes materially if a user clicked, opened an attachment, submitted credentials or approved a multi-factor authentication prompt. Review available click telemetry, endpoint alerts, sign-in logs and audit records. Look for unfamiliar IP addresses, impossible travel indicators, unusual device registrations, inbox rule creation, mailbox forwarding, OAuth consent grants and suspicious access to SharePoint or OneDrive.
Do not frame this as a hunt for proof that the user made a mistake. Employees who report quickly provide a valuable control. The operational question is whether an attacker obtained access or established persistence, and what action will reduce harm.
If compromise is suspected, follow the organisation's incident response procedures. This may include revoking sessions, resetting credentials, reviewing and removing malicious mailbox rules, blocking risky sign-ins, investigating delegated access and checking for onward phishing sent from the affected account. The exact response depends on the evidence, user role, authentication controls and sensitivity of the accessed data.
Make a defensible classification decision
Every report should end with a recorded classification, such as malicious, suspicious, spam, legitimate or simulated phishing exercise. Include the rationale, evidence reviewed, affected users, indicators identified and actions taken. Consistent classifications make reporting metrics meaningful and provide a defensible audit trail for security governance.
Analysts should avoid false certainty. A message can be suspicious but unproven, especially when the sending infrastructure is legitimate and the destination cannot be safely assessed. In that case, contain proportionately, preserve evidence and continue monitoring. Escalate where there is a credible risk of credential theft, fraud, malware, business email compromise or regulatory impact.
Remediate the message and its indicators
Once a message is confirmed as malicious, remove it from all identified mailboxes, including deleted items where appropriate, using Microsoft 365 remediation capabilities. Verify completion rather than assuming that a search-and-delete request has covered every copy. New deliveries and campaign variants may continue while the original message is being investigated.
Block or restrict known malicious URLs, domains, attachment hashes and sender infrastructure through the relevant email, web and endpoint controls. Use care with broad blocks: a compromised legitimate supplier domain may need a targeted temporary restriction and supplier engagement, rather than a permanent block that disrupts a critical service.
Notify affected users with concise, action-led guidance. Tell them what to delete, what interaction to report and where to seek support. If credentials may have been entered, provide a direct route to the service desk or security team. Vague warnings that simply ask employees to “remain vigilant” add little operational value.
Turn each report into better protection
Reported phishing is threat intelligence from the people closest to the attack surface. Trends in reports can reveal recurring supplier impersonation, weaknesses in email filtering, departments receiving targeted attacks or training topics that need attention. They can also show whether users trust and use the reporting process.
Review campaign data regularly with the SOC, email administrators, help desk and risk owners. Measure time to triage, time to remediate, repeat delivery rates, click or compromise outcomes, and the proportion of reports that identify genuine threats. Volume alone is not a useful measure: more reports may reflect a stronger reporting culture, while fewer reports may mean messages are being missed or employees do not know how to report them.
This is where a managed phishing response model can be valuable. Wise Fish supports organisations that need a defined workflow across employee reporting, phishing triage, remediation and intelligence-led improvement, particularly in complex Microsoft 365 environments.
A well-run reporting process gives employees a meaningful role without making them responsible for technical judgement. Make reporting easy from Outlook, give timely feedback where practical, and ensure the security team can act on the intelligence received. The next reported email may be routine spam, or it may be the earliest warning of a campaign already moving through the organisation. The difference lies in the quality and speed of the response.