How Do I Get Employees to Report Phishing Emails?

Fix what happens after someone reports, not the button. Employees report when a report visibly protects someone. Thank every reporter within minutes, tell them what their report stopped, share team counts in public, never name people who click, and celebrate the person who clicked and then reported. Then measure reporting first and clicks second.

The button is rarely the problem

Most vendor advice starts with friction. SoSafe's guide to better reporting opens with "remove friction from the reporting moment" and moves on to in-inbox hints and AI prompts. Friction is real. But most Microsoft 365 and Google Workspace setups already put a report option one click away, and reporting is still low.

Fortra's 2025 Phishing Simulation Benchmark covered 14 million recipients and was published in June 2026. The reporting rate was 10.5%. Fortra's own read: "9/10 phishing attempts are not reported."

People know where the button is. They've decided it isn't worth pressing.

What kills reporting happens after the click on "Report"

Often it's silence. The email disappears into a shared mailbox and nobody replies. Next time, why bother?

Or it's the brush-off. An auto-reply says, "That was a simulation. Thanks for participating!" What the employee hears: you spent effort on a fake. Reporting becomes a quiz you pass, not a thing you did for anyone.

Then there's the scoreboard. Most programs send click rate up the chain. A 2023 study by NIST researchers (Jacobs, Haney and Furman) found US government awareness programs lean on compliance metrics like completion rates. When leadership watches clicks, employees hear "don't mess up," not "speak up."

That has a cost. Amy Edmondson's 1999 research found team psychological safety predicts learning behavior, including admitting errors. An employee who expects blame for clicking will not report the email they clicked. That is the one report your security team needs most. A 2025 study at a university hospital (Tolsdorf et al.) found some staff reacted to simulations with fear, shame, guilt and even hostility. Angry, embarrassed people don't volunteer information.

Why people report at all

Burda and colleagues interviewed 49 employees who actively report phishing (Burda et al., 2025). The top reason was wanting to protect the organization and their coworkers. Second was a sense of responsibility. Nobody led with "because policy says so."

So design the program around that motive. Every report should visibly protect someone.

Five things to do after every report

Thank them within minutes

Speed is the feedback. A same-hour thank-you that names what they did beats a quarterly award. Lain and colleagues followed 14,000+ employees for 15 months and found reporting worked as a fast, sustainable, crowd-sourced detection system (Lain et al., 2022). Rozema and Davis found that in 36-55% of simulations, a report arrived before the first click (Rozema & Davis, 2026). Your fastest reporters are an early-warning system. Treat them like one.

Tell them what it stopped

For a real phish, say something like: "Your report let us pull that email from everyone else's inbox before anyone clicked." For a phishing simulation, skip "you passed." Say what the report would have stopped if the email were real, and that the security team saw it.

Share counts in public

Once a month, post team numbers: how many suspicious emails each department reported, and how many were real. Send the note to everyone, not just the people who clicked. Yin et al. (MIS Quarterly, 2026) found feedback to all employees after a simulation was more promising than feedback shown only to clickers (Yin et al., 2026).

Never name the people who click

In 2019, KrebsOnSecurity ran a piece asking whether failing a phishing simulation should get someone fired. Angela Sasse put it plainly in a 2015 paper title: "Scaring and bullying people into security won't work."

To be fair, the evidence isn't one-sided. D'Arcy et al. (2009) found perceived sanctions did reduce intentions to misuse systems on purpose. But reporting isn't about deliberate rule-breaking. It's about admitting an honest mistake fast. Punishment teaches people to hide those.

Celebrate the person who clicked, then reported

This is the most valuable report you will get. A fast report after a click means IT can reset a password or isolate a device before damage spreads. Say so out loud, by name if they're comfortable. Then share a plain what to do if you click on a phishing link guide so the next person knows reporting is the right move.

Recognition, not rewards

Be careful here, because these get lumped together. In a study of 4,554 employees, Lain et al. (CCS '24) found rewards did not improve behavior (Lain et al., 2024). So skip the points table and the gift-card raffle.

Recognition is different. A fast thank-you, a public team count, a shout-out for the click-then-report hero. It costs nothing, and it speaks to the motive Burda found. A prize turns a protective act into a transaction.

Count the right things

• Reports of real phish, not just simulations. Real reports are the whole point.
• SERR, the Suspicious Email Reporting Rate: the share of recipients who report a suspicious email.
• Time to first report: minutes from delivery to the first report.
• Click-then-report: how many people who clicked still told you.

Clicks are the second number. They swing with email difficulty: Rozema and Davis saw 7% clicks on easy emails versus 15% on hard ones. A low click rate can just mean easy emails. A rising SERR is much harder to fake. We go deeper on this in the reporting race.

Where Hook fits

Hook Security is a security awareness training and phishing simulation platform built for MSPs and SMBs. Our PsySec approach treats employees as partners, so SERR is our headline metric, not click rate. Autopilot runs training and simulations automatically each month. As Gartner's Elizabeth Davis said in June 2026, "The goal is not security awareness, but secure habits." Reporting is the habit worth building first. If you want to see how it works, book a demo.

FAQ

What is a good phishing reporting rate?

Fortra's 2025 benchmark put the average at 10.5%, so the bar is low. Track your own SERR month over month and aim for steady growth rather than a magic number.

Should we reward employees for reporting phishing?

Recognize them, don't pay them. Lain et al. (2024) found rewards did not improve behavior, while fast thanks and visible impact speak to why people report in the first place.

What should we say when someone reports a phishing simulation?

Thank them and tell them what the report would have stopped if it were real. Avoid "it was just a simulation," which tells them their effort didn't count.

What if an employee clicks a phishing email and then reports it?

Thank them first, then act on it. That report gives IT time to contain the damage, and how you respond decides whether anyone reports their next mistake.