Phishing Email Forwarding Risks: Safe Reporting, Investigation and Prevention for Employees and Security Teams

Key takeaways

• Phishing email forwarding risks rise with every additional recipient because links, attachments and QR codes stay active inside a forwarded message
• A controlled report through an approved channel and an informal forward to coworkers are different events, and only the first limits phishing email forwarding risks
• Forwarding as an attachment preserves the headers, routing data and authentication results that normal forwarding can strip away
• Cyberattacker-created forwarding rules turn a compromised mailbox into a persistent exfiltration channel that survives a password reset
• Blocking external automatic forwarding reduces phishing email forwarding risks without evicting a cyberattacker who already holds an active session
• Evidence access, retention and legal-hold decisions determine whether a phishing report creates a second privacy incident
• Continuous cybersecurity awareness training and reporting practice shorten the window between delivery and containment.

Want more from Adaptive in your Google results?

A suspicious message rarely stays in one inbox. An employee forwards it to a colleague for a second opinion, a manager passes it to accounts payable and a compromised mailbox quietly copies every reply to an external address.

Each of those movements changes who is exposed and which evidence survives for the security team. According to Verizon's 2026 Data Breach Investigations Report, 62% of confirmed breaches involve a human element, so the handling decision made in the first minute carries as much weight as the filter that let the message through.

Phishing email forwarding risks sit exactly at that seam between employee judgment and mailbox configuration. This guide covers:

• How phishing email forwarding risks differ between a controlled report, an informal forward to coworkers and a cyberattacker-created mailbox rule;
• Which reporting steps limit phishing email forwarding risks while preserving headers, attachments and original message evidence;
• What employees should do after clicking, scanning or replying, and how fast disclosure shortens containment;
• How security teams investigate phishing email forwarding risks inside Microsoft 365 and Google Workspace;
• Which privacy, retention and cybersecurity awareness training controls keep a phishing report from becoming a second disclosure.

Forwarded phishing messages spread the lure faster than analysts can recall them. Adaptive Security routes every report into one triage queue that preserves the original evidence automatically.

Take a self-guided tour

What Are Phishing Email Forwarding Risks?

Phishing email forwarding risks are the security, privacy and operational consequences that arise when a suspicious message, compromised mailbox or cyberattacker-controlled forwarding rule moves email beyond its intended recipient. Forwarding can expose credentials, malware, tracking links, business discussions and confidential files to additional people or to an account the cyberattacker controls. The severity depends on what moved, where it went and whether a person initiated the action or a cyberattacker automated it inside a compromised mailbox.

What Are the Fundamentals of a Phishing Email?

A phishing email is a deceptive message built to make a recipient reveal information, open harmful content, transfer money or take another action that benefits a cyberattacker. The message often imitates a trusted sender, supplier, executive, cloud service or internal department, then uses urgency, authority or a plausible business context to suppress careful review.

Volume explains why the handling question matters at all. According to the FBI Internet Crime Complaint Center's 2025 Internet Crime Report, phishing and spoofing generated 191,561 complaints, the highest number of reports.

The immediate danger extends well past clicking a link. A phishing email can contain a credential-harvesting page, malicious attachment, QR code, tracking pixel or reply-to address under cyberattacker control.

Even when the recipient enters no password, replying or forwarding the message can confirm that the mailbox is active, reveal internal contacts or distribute the lure to people who were never part of the original targeting. Phishing frequently becomes the opening move in business email compromise (BEC), a fraud pattern in which a cyberattacker manipulates legitimate business correspondence to redirect money or data.

After stealing a password or session token, a cyberattacker can read conversations, study payment processes, impersonate an executive or alter an existing supplier thread. The objective is access to enough context that a later request looks routine.

Employees supply a critical defensive signal at this stage. A recipient who pauses, leaves attachments closed, reports the message through the organization's approved channel and preserves the original headers gives analysts usable evidence without widening exposure.

Why Does Forwarding Multiply Phishing Exposure?

Forwarding a phishing email acts as an exposure multiplier because it expands the number of people, systems and data paths caught inside one incident. A message that originally targeted one employee can reach a finance team, executive assistant, external consultant or shared mailbox within minutes.

Each additional recipient creates another opening for credential theft, malware delivery, reply-chain manipulation or accidental disclosure. Credential theft is the pivot point that makes this expansion expensive. According to Verizon's 2026 Data Breach Investigations Report, stolen credentials were involved in 39% of breaches across the full attack chain.

Good intent does not cancel the exposure. A person can forward a message to warn a colleague and still place a malicious link in front of that colleague.

A manager can forward an invoice-themed email to accounts payable and unintentionally make a fraudulent request look internally endorsed. An employee can forward a suspicious document to a personal account for later review and move company data outside administrative and retention controls.

Forwarding also enriches cyberattacker intelligence. Delivery to a new address can reveal organizational relationships, reporting lines and active projects, while replies confirm employee names, writing styles and business routines.

The business impact grows when the forwarded message carries a live session link, password-reset request or document holding sensitive information. A forwarded customer record, contract, payroll file or acquisition discussion creates privacy, legal and competitive exposure on top of the original security problem. Organizations reduce that compounding effect by making the safe action unmistakable: report the message through a controlled channel, leave other employees out of the distribution and reach the security team through a separate trusted method whenever credentials, payments or sensitive data are involved.

Adaptive Security's Phish Triage supports centralized reporting and automated classification so employees can send the signal to analysts without turning one suspicious email into a wider distribution event.

How Do Manual Forwarding and Automatic Forwarding Rules Differ?

Manual forwarding is one user action. The employee selects a message and sends it onward, usually to request assistance, act on a message believed to be legitimate or warn a colleague. The exposure is immediate and generally bounded by the recipients chosen and the content included.

Manual forwarding turns especially dangerous when it involves an external address. A personal mailbox, temporary contractor account or cyberattacker-controlled address can receive the original message, its attachments and the conversation history attached to it.

An employee who forwards a phishing email containing a credential-harvesting link hands the external recipient the same lure. An employee who forwards a legitimate business thread after clicking that lure may give the cyberattacker valuable context for a more convincing second-stage impersonation.

An automatic forwarding rule behaves differently because it operates without a fresh decision for every message. A cyberattacker who gains mailbox access can create a rule that forwards messages matching terms such as "invoice," "payment," "password," "wire," "contract" or "confidential" to an external address, then receives future business email while staying quiet inside the account.

The rule can keep exfiltrating information after security staff reset the password or revoke active sessions, until someone finds and removes it. That persistence makes mailbox cleanup as important as credential reset.

Investigators should review inbox rules, transport rules, delegated access, OAuth application permissions, mailbox audit logs and forwarding settings, remove unauthorized persistence and establish what data left the organization. CISA's SCuBA configuration baseline for Exchange Online requires disabling automatic forwarding to external domains and enabling mailbox auditing.

Those controls give defenders visibility into unauthorized changes before a forwarding rule becomes a long-running data-loss channel. The distinction also shapes response: a manually forwarded phishing email calls for message recall where possible, recipient notification, link and attachment analysis and targeted credential checks.

An unauthorized automatic rule calls for account containment, rule removal, session revocation, authentication review, mailbox audit analysis and a search for sensitive messages sent externally. Security teams should treat both events as reportable signals while scoping them separately.

A suspicious email sent to the security team for investigation is controlled escalation. A suspicious email sent to coworkers is internal redistribution, and a cyberattacker-created rule that forwards legitimate business email externally is an active persistence and data-exfiltration mechanism.

That clarity gives employees a practical decision rule for phishing email forwarding risks: report suspicious email through the approved channel, preserve the original message when instructed and alert security immediately if forwarding already occurred or an unexpected rule appears.

How Can Forwarding a Phishing Email Create Additional Risk?

Forwarding a suspicious message rarely executes its attachment or activates every element inside it. It still increases phishing email forwarding risks by placing the same bait in front of new recipients who might click a link, open an attachment, scan a QR code, reply to the cyberattacker or load remote content.

CISA's 2023 phishing guidance advises users to leave suspicious links and attachments alone and to report them through an established channel.

What Happens When a Forwarded Email Contains Active Content?

Forwarding preserves much of an email's original content. A malicious link remains clickable, an attachment remains downloadable and a QR code remains scannable, even though the message now appears to come from a colleague.

The forward changes the audience while leaving the cyberattacker's objective intact. A link can lead to credential theft, malware delivery, a fake payment page or an unexpected sign-in request, and one message can hold several destinations at once.

A visible button may point to one domain while its underlying HTML anchor points to another, and a shortened URL can conceal the destination entirely. A recipient who trusts the colleague forwarding the message often inspects it less carefully than an unfamiliar external email.

Attachments create a related but distinct risk. Forwarding an email with a PDF, spreadsheet, archive, document or script attached rarely runs the file on either device, because execution generally requires another event such as opening the file, enabling active content, extracting an archive, clicking a link inside the document or approving a security warning.

That distinction supports a calm response. Forwarding is one step short of infection, yet it still moves a hazardous file into a new inbox where another person will interact with it.

A note such as "Can someone confirm whether this is legitimate?" adds social proof and can prompt a finance employee to open an invoice during review. Phishing remains a leading entry point for breaches. According to IBM's Cost of a Data Breach Report 2026, phishing remained the top initial attack vector for the fourth consecutive year, with voice and SMS phishing (vishing/smishing) involved in 17% of breaches and carrying the highest average breach cost.

QR codes create the same hazard through a less visible channel. A recipient can scan a code from a laptop screen with a personal phone, bypassing protections applied to desktop email and browser traffic.

The code may lead to a fake Microsoft 365 sign-in page, a payment redirection site or an application download, so the forwarder's warning quietly distributes another delivery path. Remote images and tracking pixels create quieter exposure still.

When a mail client loads external content, the request can tell a tracking service that the message reached an active mailbox and can disclose technical metadata such as an IP address, access time, user-agent details or a unique identifier. Modern clients often block or proxy remote images, so the outcome is never guaranteed.

The safer assumption is narrower: forwarding proves nothing about whether a pixel fired, and it gives more mailboxes and devices an opportunity to request the content. Rendering also differs across desktop clients, mobile applications, webmail interfaces, preview panes and archiving systems. An email that looks inert in one interface can expose a link or load remote content in another.

The organization's reporting workflow handles this problem better than ordinary forwarding. A dedicated report action preserves the message for analysis without redistributing live content, and a phishing response and triage workflow can collect original headers, classify the message and support organization-wide remediation after one employee reports it.

How Does Forwarding Alter Message Context and Authentication Evidence?

Forwarding changes the message's context even when the visible body survives intact. The new recipient sees the colleague who forwarded it, not the external sender who delivered it, and that display creates a false trust signal.

The effect strengthens when the forwarder adds "This looks suspicious" or "Please review," because the recipient focuses on the colleague's identity and overlooks the original sender, destination domain, reply-to address or authentication warning. Email authentication also demands careful interpretation after forwarding.

SPF, DKIM and DMARC evaluate different relationships among the sending infrastructure, the authenticated domain and the visible From address. Forwarding can add new Received lines, change the envelope path and affect authentication alignment, so some arrangements preserve DKIM and pass DMARC while others break alignment or invoke forwarding-specific mechanisms such as ARC.

Forwarding leaves a legitimate message legitimate, and one authentication pass or fail indicator still falls short of a complete verdict. Analysts and recipients should examine the original authentication results, message path and sender details together.

The Reply-To field deserves particular attention. A cyberattacker can make the visible From address resemble a trusted sender while directing replies to a separate mailbox, and forwarding does not necessarily remove that instruction.

Replying to the forwarded message can therefore send information to the cyberattacker instead of the colleague who shared it. The tactic supports invoice fraud, credential collection and BEC, especially when the message requests payment details, passwords, documents or confirmation.

A forward can also obscure the original chain of custody, since headers may be reordered, added or wrapped by the mail client. Pasting a message removes still more evidence, including routing data, authentication results, attachment metadata and the original Message-ID.

Even a standard forward adds a new message ID and delivery timestamp, which obscures when the original arrived and whether the content changed.

Analysts need the original message, complete headers, attachment hashes, URLs, timestamps and recipient list to establish whether a campaign reached other people. A normal forward can support an initial review while falling short of the original message or a dedicated reporting mechanism.

Employees should report before taking further action. Anyone who opened a link, scanned a QR code, entered credentials, downloaded a file or replied should include that detail in the report so the security team can prioritize containment.

How Can Forwarding Expose Confidential Thread Content?

Forwarding creates a separate information disclosure risk because the sender may transmit an entire conversation in place of the suspicious message alone. A thread can contain customer records, internal decisions, legal advice, payment details, contract terms, personal information or earlier attachments unrelated to the phishing attempt.

The cyberattacker's bait then becomes the reason sensitive organizational content reaches an unintended mailbox. The risk climbs when employees send threads outside the organization for verification.

A recipient might forward the conversation to a personal address, external consultant, vendor or public abuse-reporting mailbox. Even when the purpose is legitimate, the copied history usually exceeds what the reviewer needs and can expose email addresses and contact relationships that support more convincing spear phishing.

Thread content reveals operational detail such as approval paths, executive travel, payment schedules, software providers, internal project names and normal finance language. Cyberattackers use those details to refine a follow-up message.

This is internal operational detail that a cyberattacker would otherwise have to research, handed over through ordinary email handling. Separating evidence from conversation keeps that leakage contained.

Employees should report the message through the approved button or security queue, preserve the original in its native form and limit follow-up recipients to those who need to act. When a manual forward is unavoidable, only the suspicious message should travel to the authorized security address, with no external recipients added and a clear warning that links, attachments, QR codes and reply functions remain active.

No employee should be blamed for asking whether a message is safe. Reporting uncertainty gives the security team a chance to contain the message before another person interacts with it, which is the practical difference between an isolated lure and an organization-wide incident.

Several colleagues often see a suspicious message before anyone in security analyzes it. Adaptive Security replaces informal forwarding with one reporting action that keeps links, attachments and live content contained.

Explore the platform

How Should Employees Manage Phishing Email Forwarding Risks and Report a Suspected Phishing Email?

Safe reporting begins by stopping interaction, preserving the message and using the organization's approved reporting channel. Managing phishing email forwarding risks means selecting the built-in Report phishing control or the organization-specific phish-report button, forwarding the message as an attachment only when no reporting control exists or the security team requests the original and disclosing immediately whether credentials or sensitive data were entered.

The four steps below describe that sequence from first suspicion through confirmed receipt.

1. Stop Interacting With the Message

Employees should stop giving the message opportunities to trigger an action. That means no additional clicks, no opened attachments, no reply to the sender, no calls to a number in the email, no scanned QR codes and no continuation of a conversation that began through the suspicious message.

If the message is already open, the approved reporting control can be used without touching its contents, and the message closed afterward. Deletion should wait unless the organization's procedure specifically instructs otherwise.

Security teams may need the original message, headers, sender information, embedded links, attachment metadata and delivery details to determine whether other employees received the same campaign. Keeping the message intact preserves evidence that manual copying or forwarding can alter.

Any completed action changes the category of the event. Clicking a link, opening an attachment, entering a password, approving a multifactor authentication request, transferring money or sharing sensitive information turns a suspicious email into a possible incident and calls for immediate contact with the security or help desk team through a trusted channel.

A phone number or reply address supplied by the suspicious message is never the right route back.

The same rule holds when the email appears to come from a colleague, executive, customer or supplier. Familiar branding and a known name make a message look safe without making it safe, because a BEC attempt can use a compromised account, a lookalike domain or a carefully constructed request that appears to continue a legitimate business process.

The employee's responsibility is to stop the interaction and preserve the signal for review, and proving that the message is malicious belongs to the analysts.

2. Select the Approved Reporting Channel

The reporting channel configured for rapid triage should carry every report. In Outlook or Gmail, the built-in Report phishing or Report message control is the first choice when the security team has approved it.

These controls preserve message data and route the report to the right analysts without requiring anyone to copy suspicious content into a new email. CISA's phishing guidance emphasizes prompt reporting so defenders can investigate the message and stop related attempts.

Some organizations use a dedicated Phish Alert Button in the mail client, browser or mobile application. Employees should select it once, follow the confirmation prompt and avoid submitting the same message through multiple channels unless the security team asks for it.

Duplicate reports obscure the original timeline and create unnecessary analyst work. A properly configured workflow confirms whether the email was submitted, removed from the inbox or routed for review.

Where no built-in control exists, the security team's trusted reporting address or ticketing system takes its place. That address should come from an internal directory, security portal, onboarding guide or previously verified contact.

Searching the suspicious message for reporting instructions is dangerous, because cyberattackers can place a fake "report this email" link inside the message to collect credentials or confirm that the account is active.

Attachment forwarding applies only when no reporting control exists or the security team specifically requests the original file. An attached forward preserves more technical context than copying visible text into a new message, so the mail client's Forward as attachment option should be used where available, and the attached message left unopened after creation.

When the procedure asks for headers, they should travel unedited alongside the original content. Several categories of message should never be forwarded at all.

Those include messages containing active malicious content, sensitive personal information, protected health information, confidential customer data or explicit instructions against redistribution. Where forwarding is prohibited, the reporting control or a ticket that identifies the message without reproducing its contents does the job.

For employees using Adaptive Security's Phish Triage workflow, the reporting action sends the message for classification and remediation without manual distribution. Whatever the tool, the organization's configured process should govern the response, because an active incident is the wrong moment to invent a new one.

3. Report From a Mobile Device Without Reopening the Lure

Mobile reporting requires the same discipline because small screens hide sender details, full URLs and attachment names. Employees should open the message only inside the organization-approved mail application, use its Report phishing control or Phish Alert Button and confirm that the report completed.

Tapping links, downloading files, replying or switching to a personal browser all defeat the purpose of reporting.

If the mobile application lacks a reporting control, the security team can be reached through a trusted phone number or internal messaging channel. The right question is whether the team wants a screenshot, the original message or no forwarded copy at all.

A screenshot shows what appeared on screen while omitting the technical evidence analysts need, and screenshots that expose passwords, authentication codes, customer records or other sensitive information create a second problem.

Channel changes the route without changing the principle. A suspicious text message belongs in the organization's smishing reporting process rather than a group chat.

A message that arrives through a personal account while impersonating the organization should reach the security team from a work device or trusted channel, with a note that the original account was personal. The core rule holds across every channel: stop interacting and avoid spreading the message.

4. Document the Incident and Confirm Receipt

A complete report gives the security team enough context to prioritize the event without anyone reopening the message. Useful reports name the recipient or account that received it, the approximate date and time, the sender display name and address if visible, the subject line and the device or application used.

They also state plainly whether the employee clicked a link, opened an attachment, replied, called a number, scanned a QR code, approved a login request or took no action.

Disclosure of what was entered matters as much as what was clicked. The report should record whether a password, authentication code, payment information, customer data, employee data or other sensitive material was submitted, identifying the affected account without including the password itself.

An approved multifactor authentication request belongs in the report because it changes the urgency of the response. Transferred funds or a changed supplier record call for immediate escalation by phone through a trusted internal contact instead of waiting for email triage.

A concise report reads like this:

Received by finance@company.example at approximately 10:15 a.m. on a company-managed iPhone. Message opened; no click, reply or download. Reported through the mobile Report phishing control. No credentials or sensitive data entered.

That format separates observed facts from assumptions and gives analysts a reliable starting point. Confirmation closes the loop.

Employees should save the ticket number, automated confirmation or case reference. When no confirmation arrives within the organization's stated window, a trusted channel and the time of the original submission are enough to reopen the thread, while repeated submissions only add noise.

A report is complete once the message has reached the approved security channel, the organization knows whether interaction occurred and the employee holds a case reference or direct confirmation. At that checkpoint, a suspicious email becomes a usable security signal and the reporting path stops resembling ordinary correspondence.

Turn every reported message into a classified, evidence-preserving case with Adaptive Security's phish triage workflow, and give employees one control that ends the guesswork around forwarding a suspicious message.

Book a demo

Why Should a Phishing Email Be Forwarded as an Attachment?

For phishing email reporting, the decisive choice sits between sending a normal forward and attaching the original message to a new email. A normal forward creates a fresh message that presents the suspicious content as readable text, while attachment forwarding preserves the original message as a separate evidence object.

Normal forwarding can alter or omit headers, routing details, timestamps and authentication information that analysts need, so attaching the original message gives investigators a fuller record and reduces the chance that someone interacts with links, images or files in the suspicious body.

How Does Attachment Forwarding Preserve Evidence?

A phishing investigation depends on details that routine forwarding obscures. Analysts often need the underlying sender address, received path, message ID, authentication results, originating systems, delivery time, reply-to address and attachment structure.

A new forward makes the reporter's account, mail server and current timestamp the most visible metadata, which documents the report while hiding the original delivery context.

Forwarding as an attachment keeps the suspicious email in its original message format, typically as an .eml or .msg file. Analysts can then inspect the original headers separately from the reporting message, including:

• Received, which records how the message moved through mail infrastructure;
• Return-Path, which identifies the envelope sender;
• Message-ID, which helps correlate related messages;
• Authentication-Results, which records authentication checks;
• DKIM-Signature and ARC-Seal, which provide additional delivery and authentication signals.

On their own these fields support analysis without delivering a verdict, and they give investigators evidence that a copied subject line or screenshot cannot supply.

The attached message also preserves artifacts that normal forwarding flattens or changes, including the original HTML structure, embedded images, tracking elements, attachment names, MIME boundaries, reply-to fields and links as they appeared on delivery. That context helps analysts compare related reports, identify a reused campaign and determine whether the email reached other inboxes.

It also supports safer automated processing, because a triage system can classify the attached original without asking the reporter to click through the suspicious content.

Preservation has to come before investigation. Employees should avoid opening, editing, replying to or resaving the suspicious message before an original copy exists, since altering the only copy destroys evidence the security team needs.

When a broader audience needs an example for cybersecurity awareness training, a sanitized copy created after the original is retained, and labeled as training material, solves that problem cleanly.

A practical evidence-preservation workflow includes:

• Preserve the original message in its native form before investigating it;
• Forward the preserved message as an attachment to the designated security mailbox or reporting workflow;
• Add context outside the attachment, including who reported the message, when it arrived, whether it was opened and whether the reporter clicked, replied, downloaded or entered credentials;
• Keep reporter notes outside the suspicious message so analysts can distinguish original content from added context;
• Treat screenshots as supplemental evidence alongside the original message.

The reporting workflow should make that process effortless for employees. A phishing response and phish triage workflow can accept the original message, classify it and guide the reporter without demanding technical knowledge of headers or MIME structure.

What Is the Difference Between Normal Forwarding and Forwarding as an Attachment?

Normal forwarding is built for communication between people. It places the earlier message into a new composition window, usually as quoted text, and can carry over visible attachments or selected content.

That format serves a colleague who needs business context while changing the investigative record: the new message has a new sender, timestamp and routing path, and portions of the original headers may appear as text, stay hidden or disappear entirely.

Normal forwarding also raises accidental interaction risk. The reporter typically sees the suspicious subject line, body, buttons, images and links while preparing the forward.

A rushed user can click a call to action, open a malicious attachment, reply to the cyberattacker or send the message to the wrong recipient, and in some mail environments suspicious HTML can load remote content during composition. Normal forwarding carries no automatic danger, yet it requires more handling of the phishing message than most employees should perform.

Forwarding as an attachment changes the purpose from conversation to evidence transfer. The recipient receives a new reporting message with the original email enclosed as a discrete file, so the reporting message can carry a short description of what happened while the attached message stays available for header, content and artifact analysis.

That separation gives the analyst both layers: the reporter's account of events and the original message as delivered.

The distinction carries real weight for BEC, invoice fraud, account takeover attempts and vendor impersonation. A message can look credible while its sender infrastructure, reply-to address or authentication path reveals a mismatch.

Attachment forwarding leaves the email exactly as dangerous as it was, while giving the response team a more reliable object to examine. When no reporting control exists or the security team requests the original, employees should use that function, send the result only to the organization's approved reporting address and describe any interaction in the new message.

How Can Gmail and Outlook Users Preserve the Original Message?

Gmail users should forward an email as an attachment through the message action, which preserves far more than copying the body into a new message. Google's Gmail guidance for downloading and forwarding emails as attachments describes the supported workflow and explains how to include the original message as an attached file.

Controls vary by account type, device, browser and administrator settings, so the organization's reporting process should override any personal shortcut.

Gmail also allows users to inspect message headers through the message's additional details or "Show original" view, depending on the interface. Header extraction becomes useful when the reporting workflow cannot accept an attached message or when the security team requests raw header text.

The complete header block should travel into the approved reporting channel with its line breaks and values unchanged, because copying only the visible From, To and Subject fields omits the full delivery path and authentication context.

Outlook handling differs across desktop, web, mobile and managed organizational environments. Many Outlook configurations offer an option to forward the original message as an attachment through message actions or additional response options, although the label and location vary.

Some environments create an attached .msg file, others accept an .eml file and others require the message to be saved and then attached. The operating principle stays constant: preserve the original message file, leave it unedited and send it through the approved reporting channel.

When Outlook fails to expose the expected option, improvisation creates more risk than delay. Opening links, dragging content into a new message or forwarding the suspicious email to a personal account all widen phishing email forwarding risks without helping the investigation.

Contacting the service desk or security team to ask which method the organization supports keeps the report inside a controlled path, and a controlled report reaching the right destination beats a technically complete message arriving in the wrong one.

What Should an Employee Do When the Message Cannot Be Attached?

Attachment is not always available. Mobile applications, restricted mailboxes, delegated accounts, retention policies and security controls can all limit the actions on offer, and none of those limitations justifies skipping the report or manipulating the email until it becomes easier to send.

When attachment forwarding is unavailable, employees should preserve the message in place and report it through the organization's approved button, mailbox, ticketing system or service desk. The report should include the sender address, subject, arrival time, recipient mailbox and a concise description of what happened.

It should also state whether the message was opened, whether a link or attachment was accessed, whether credentials were entered and whether a reply or payment instruction was sent, since those details help analysts prioritize containment even without the original file.

Header extraction is the preferred fallback whenever the reporting team requests it, using the full-header view in Gmail or the message properties and internet-header view in Outlook. The complete header block should be copied without altering line breaks or values before it travels through the approved channel. Interface names differ across versions, so organization-specific instructions carry more authority than any single set of steps.

Screenshots supplement a report usefully, particularly for a message viewed on a mobile device, while remaining weak primary evidence. A screenshot shows visual impersonation, wording, branding and the apparent sender while omitting routing data, hidden links, authentication results and attachment metadata.

Where the original message or headers can still be preserved, they should be.

Retention decisions belong to the security team. Employees should keep the suspicious email available until handling instructions arrive and avoid deleting it unless the reporting workflow explicitly removes it after capture.

Forwarding it externally for advice or submitting it to a public analysis service without authorization can expose confidential business information, personal data or an active tracking element. Preserving the original before sanitizing it protects the investigation and gives the organization safer material for future cybersecurity awareness training.

Adaptive Security captures the original message, headers and attachments the moment an employee reports it, then classifies the case before a second mailbox ever sees the lure.

Take a self-guided tour

What Should Employees Do After Clicking, Opening, Scanning, Replying to or Disclosing Information in a Phishing Email?

After any phishing email interaction, employees should stop communicating with the sender, contain the device or account and notify the IT or security team immediately. Exposed credentials need changing from a known-safe device, exposed financial data needs a call to the bank or affected provider and the message and related evidence need preserving.

Every interaction counts as reportable even when nothing appears wrong, because cyberattackers use one interaction to test access, steal information or prepare a follow-up attempt.

1. Contain the Device and Stop the Interaction

Immediate containment limits what follows a click, attachment opening, QR scan or reply. Continued browsing, additional replies, calls to a number in the email or a correction sent to the cyberattacker all extend the exposure window.

The phishing page should close and the email should stay intact so the security team can investigate it. Speed matters because intrusions move quickly once access exists. According to the CrowdStrike 2026 Global Threat Report, the average adversary breakout time, the window between initial access and lateral movement, dropped to 29 minutes, with the fastest measured at just 27 seconds.

A click without disclosure still deserves a report, because a familiar logo or a page that disappears proves nothing about whether the interaction was harmless. A malicious page can attempt drive-by downloads, collect browser details or redirect the visitor to another site.

Opened attachments raise the containment threshold, particularly executables, scripts, macro-enabled documents, archives and unexpected PDFs. Where organizational policy permits it, the device should come off Wi-Fi and wired networks.

Shutting down or restarting the device should wait for IT instruction, because volatile evidence and active indicators disappear on reboot. CISA guidance on phishing warns that harmful links and attachments can expose sensitive information or install malware, so suspected malware calls for prompt isolation in place of quiet observation.

A QR code deserves the same response as a clicked link. When the scan happened on a personal phone, the resulting page should close, no application or configuration profile should be installed and the destination should be reported.

When the scan happened on a company-managed device, IT needs to know which device was used and whether credentials were entered, an MFA request approved, anything downloaded or permissions granted.

Replying creates a different problem. The conversation should stop without revealing that the scam was recognized, and no second message should confirm the employee's role, schedule, phone number or authority.

A reply verifies that the mailbox is active and gives the cyberattacker material for a more convincing spear phishing or BEC attempt. The original message belongs in the organization's approved reporting process, never in a forward to coworkers, customers or vendors.

The organization's phishing response and phish triage process should capture the message, device, time of interaction and actions taken. Employees who report quickly give security teams the signal they need to search for similar messages and remove them from other inboxes, and blame has no place in that exchange.

2. Secure Credentials and Financial Accounts

Credential exposure calls for action from a known-safe device, never the device that visited the phishing page. A company-managed computer or a trusted phone that stayed clear of the message is the right starting point.

The account should be reached through a saved bookmark or a typed organizational address, never through the suspicious email or a search advertisement.

Password changes should cover every account whose password, username, security answer, one-time code or MFA approval was disclosed, starting with the compromised account and extending to every other account that reused the same password. Unique passwords and MFA both help, and neither justifies delaying the report.

A cyberattacker holding a password and an active session can act before a password reset propagates to every system.

Session revocation matters as much as the reset itself, because a password change alone does not always terminate sessions established before it. Active sessions, browser tokens, app passwords, connected applications, recovery methods and remembered devices should be revoked wherever the service provides those controls.

IT can also invalidate enterprise sessions, review mailbox forwarding rules and check for newly registered MFA devices or OAuth applications.

Precision helps the responders. Employees who entered credentials into a phishing page should give IT the exact account and time, and anyone who approved an unexpected MFA prompt should say so plainly.

Cyberattackers combine stolen passwords, MFA fatigue and help desk impersonation, so the security team needs the complete sequence from password capture to help desk contact.

Payment data requires a financial response running in parallel with the security response. The card issuer or bank should be contacted using the number on the physical card, an official statement or a verified website, with a request to freeze or replace the card, block unauthorized transfers, monitor the account and recall or reverse any fraudulent wire payment.

For business accounts, the treasury team and bank fraud unit need immediate notice, approval records need preserving and the organization's dual-control procedures apply. The FBI Internet Crime Complaint Center's 2025 account-takeover alert recorded more than 5,100 complaints and over $262 million in reported losses since January 2025. Rapid bank notification improves the chance of recovering funds.

An IC3 complaint is appropriate when money, account access or sensitive information was stolen, and it should include transaction details, contact information used by the cyberattacker, URLs, phone numbers, wallet addresses and the timeline.

Disclosed health information belongs with the privacy, compliance or legal team instead of the help desk alone. The organization needs to identify the records exposed, the recipients, the patient or member population affected and whether protected health information was involved before determining containment, notification and regulatory obligations.

Disclosed customer information deserves the same disciplined handoff. Security and the data owner need to know which categories were shared, such as names, addresses, account numbers, support records, contracts or identity documents.

Independent outreach to customers and deletion of evidence both undermine the response before the organization has established an approved communications and investigation plan.

3. Preserve Evidence and Document the Timeline

Evidence preservation turns an accidental interaction into an actionable incident record. The record should capture when the message arrived, when it was clicked or opened, the device and network used, the page or phone number involved and every action taken afterward.

It should also state whether credentials were entered, a file was downloaded, a reply was sent, a QR code was scanned, an MFA prompt was approved or financial, health or customer information was disclosed.

The original message should stay in the mailbox whenever the security team requests it. Editing the subject line, removing the attachment, changing sender details or sending an ordinary forward can all alter headers.

The organization's reporting button or written instructions allow analysts to capture the original message and its technical metadata intact.

Supporting artifacts need the same care. Screenshots of suspicious pages, payment instructions, QR destinations and error screens are worth saving when capturing them is safe, and URLs should be copied as text without revisiting them.

Downloaded files should stay in place, unopened, unrenamed and unshared, with no upload to public malware scanners unless IT provides a controlled process.

Analysts also need the surrounding context, including whether the message reached other employees, whether a reply was sent and whether the sender requested secrecy or urgency. Unusual browser behavior, new login alerts, password-reset messages, mailbox rules, missing files and unfamiliar outbound messages all help distinguish a contained click from an account takeover or malware event.

Deletion should wait for the security team's confirmation. Removing the email can destroy the evidence needed to identify the campaign and search for related messages.

Once security confirms that evidence is captured and containment is complete, its instructions govern deletion, device reimaging, password recovery and monitoring. Employees should close the loop by asking what was reset, which sessions were revoked, whether the device was scanned or isolated and what monitoring continues.

When an employee hesitates to admit a click, containment starts hours late. Adaptive Security makes disclosure a routine reporting step rather than an admission of personal failure.

Explore the platform

Who Should Receive a Forwarded Phishing Email? Reporting Destinations and Phishing Email Forwarding Risks

The right destination for a reported message depends on whether it is routine spam, a targeted attempt, fraud or a potential data breach. The internal IT or security team should receive it first because that team can preserve evidence, check whether other employees received it and remove related messages centrally.

The email provider's reporting function suits ordinary spam and junk-folder messages while leaving internal investigation untouched. A national cyber authority, financial institution or law enforcement agency becomes important once the message involves coordinated targeting, money, identity theft, personal information or regulated data.

Why Internal Reporting Should Come First

Internal reporting is the default destination wherever the organization has a defined process. The Phish Alert Button, the security team's designated mailbox and the approved service desk workflow all satisfy that requirement.

Organizations should make that path obvious in advance. The same guidance instructs organizations to establish reporting procedures and encourages prompt reporting of phishing incidents, and a one-click phishing response and triage process gives employees a clear action without asking them to diagnose the cyber threat themselves.

The table below maps common situations to their primary destination and the action that should follow.

When Should Organizations Report Externally?

External reporting supplements internal response. For ordinary spam, the email provider's native "Report spam" or "Report phishing" function helps the provider filter similar messages for that mailbox and others.

Employees with corporate accounts should notify internal security whenever the message imitates a colleague, requests action, contains a malicious attachment or reaches the inbox despite existing controls. Suspected campaigns belong with the relevant national cyber authority when the activity appears coordinated, targets multiple people, impersonates a public institution or affects a broader community.

In the United States, CISA accepts organizational cyber incident reports while the FBI Internet Crime Complaint Center receives reports involving cyber-enabled fraud and crime. According to the FBI's 2025 Internet Crime Report (released April 2026), cyber-enabled fraud accounted for almost 85% of all losses reported to IC3, totaling $17.7 billion (up from $13.7 billion in 2024). Business email compromise accounted for $3.05 billion in losses across 24,768 complaints, averaging about $123,000 per complaint.

Organizations should preserve transaction records, headers, screenshots, recipient details and timelines before submitting a complaint through the IC3 reporting portal.

Financial institutions need immediate notice when a phishing email triggered a transfer, changed payment instructions, exposed banking credentials or caused payroll diversion. The bank should be reached through a verified number from its official website or an account statement, never through contact details supplied in the message.

Law enforcement becomes appropriate once money was lost, identity information was stolen, extortion occurred, threats were made or the incident involves a significant business or public-sector target. Prompt escalation gives investigators and financial institutions more time to trace activity and limit losses.

What Are the Escalation Thresholds?

Escalation belongs at the point where the email creates risk beyond one suspicious message. A targeted attempt aimed at an executive, finance employee, administrator or supplier deserves urgent internal review even when nobody clicked, because the sender may be testing who responds and which controls fail.

Any completed action moves the event from routine phishing report to incident. That category covers clicking a link, opening an attachment, entering a password, approving a multifactor authentication prompt, sending personal data, changing payment details or transferring funds.

Disconnecting from a network limits further exposure, and internal security still needs immediate contact. Employees should leave evidence intact and avoid investigating the device independently.

Messages containing health records, payment-card details, government identifiers, employee records, customer data or confidential business information require privacy and compliance review. Forwarding those messages externally without authorization creates a second disclosure, so only the minimum necessary information should travel through an approved channel.

Where no internal reporting process exists, the email provider's phishing-report function, a manager or designated IT contact and a written record of what happened form a workable substitute. When credentials, money or regulated information were involved, the affected institution and the appropriate national reporting authority should hear about it without waiting for a formal workflow.

Spam filters remove one message while coordinated campaigns keep reaching other inboxes. Adaptive Security connects employee reports to organization-wide search and removal across every affected mailbox in the tenant.

Book a demo

How Do Cyberattackers Use Compromised Mailboxes and Malicious Forwarding Rules to Create Phishing Email Forwarding Risks?

Phishing email forwarding risks escalate sharply once cyberattackers compromise a mailbox and turn it into a trusted internal channel. They can send messages from a legitimate account, monitor replies, redirect invoices and capture password resets without triggering the suspicion an unfamiliar domain would attract.

Red Canary's Threat Detection Report documents forwarding rules that conceal activity, exfiltrate sensitive messages and keep delivering data to cyberattackers after they lose direct account access.

How Do Cyberattackers Abuse a Compromised Mailbox?

Cyberattackers enter a real employee's mailbox with stolen credentials, a session token or a successful phishing attempt. The account then becomes an authenticated platform for follow-up fraud, such as a finance employee requesting a vendor bank-account change or an executive creating urgency around a payment, contract or confidential document.

Recipients who would question an external sender routinely trust an internal address, particularly when the thread contains genuine earlier messages.

The cyberattacker monitors replies to the fraudulent request to identify invoice approvers, payment schedules and challenges raised by other employees. That intelligence allows BEC operators to adjust the story in real time instead of relying on one isolated phishing email.

Identity-based deception has grown alongside it. According to Sumsub's 2025–2026 Identity Fraud Report, sophisticated multi-step fraud attacks rose 180%, climbing from 10% to 28% of all identity fraud.

Malicious forwarding rules make the compromise persistent. A rule can redirect messages to an external mailbox, retain a copy in the legitimate inbox or move selected messages into a hidden folder.

Resetting the employee's password and revoking active sessions leaves those rules untouched, so the cyberattacker can keep receiving invoices, replies and account-recovery messages until security staff inspect and clean the mailbox.

Which Forwarding Rules Indicate a Mailbox Compromise?

Suspicious rules usually look insignificant instead of operationally useful. Names consisting of a period, semicolon, single letter or repetitive characters slip past a quick review.

A rule named ".", "aaa" or "mail" demands investigation when it forwards or redirects messages outside the organization, particularly if it appeared shortly after an unusual login.

Conditions reveal the cyberattacker's objective. Rules acting on messages that contain terms such as "invoice," "payment," "payroll," "wire," "ACH," "password," "reset" or "verification" deserve immediate scrutiny.

Rules targeting a specific executive, vendor, human resources address or finance group are equally concerning because they focus surveillance on high-value conversations while leaving routine mail untouched.

Cyberattackers also hide evidence from the account owner. A rule that marks messages as read, deletes them, moves them to RSS, archive or another obscure folder, or removes them from the inbox can conceal the fraudulent exchange entirely.

A forwarding rule paired with a move or read-status action is especially serious because it combines exfiltration with concealment.

Security teams should compare each rule's creation time, source IP, device details and authentication history. A rule created from an unfamiliar country, anonymizing service or device outside the employee's normal pattern requires immediate containment.

Mailbox audit records show new, modified, disabled or deleted rules, and the review should end with unauthorized forwarding removed and confirmation that no external address remains attached to the mailbox.

What Information Do Cyberattackers Target?

Cyberattackers target information that enables theft, extended access or trusted impersonation. Invoice threads reveal payment schedules, banking instructions and vendor contacts, while password-reset messages can expose links or codes that unlock additional services.

Payroll and human resources email can contain tax forms, personally identifiable information and employee account details that support identity fraud.

Executive and finance mailboxes attract special attention because they connect authority to transactions. A forwarding rule aimed at a chief financial officer's messages can expose acquisition discussions, payment approvals and banking relationships.

A rule aimed at an accounts-payable employee can supply enough context to alter an invoice before payment while keeping the exchange inside a legitimate thread.

Stolen correspondence then feeds the next round of social engineering. It gives cyberattackers names, writing styles, project details and current business events for personalized spear phishing, vishing or smishing.

Security teams should treat unexpected forwarding as an active incident, reset credentials and sessions, inspect related accounts and verify payment changes through a separate trusted channel. Employees strengthen that response by reporting missing messages, unexpected read status or unusual mailbox behavior, which gives defenders a chance to remove access before stolen context becomes another convincing request.

A malicious forwarding rule can outlive a password reset until removed. Adaptive Security pairs cloud email security with reporting practice so hidden persistence surfaces before the next fraudulent invoice.

Explore the platform

How Can Organizations Prevent and Detect External Email Forwarding?

Organizations reduce phishing email forwarding risks by blocking automatic forwarding by default, documenting narrowly scoped exceptions and monitoring every rule change. Administrators should review existing mailbox rules, alert on suspicious forwarding activity and connect authentication logs with email audit events.

1. Prevent Unauthorized External Forwarding

Prevention starts with a tenant-wide policy that disables automatic forwarding from organizational mailboxes to external addresses. That control stops a cyberattacker from copying incoming messages to a personal inbox or infrastructure address after stealing a password through a phishing email.

The restriction belongs in the email administration console centrally, because individual mailbox settings are the first thing a cyberattacker changes.

Legitimate business cases still exist, including approved legal holds, customer service workflows, merger activity and controlled partner processes. Each should run through a documented exception with a named owner, business justification, destination-domain restriction, expiration date and security review.

Permanent exceptions and forwarding to consumer mail services both deserve refusal unless the organization has a specific approved reason.

Layered controls work better than treating forwarding as the only safeguard:

• Block external automatic forwarding by default and restrict approved exceptions to authorized domains or service accounts;
• Require stronger authentication for administrators and high-risk users, since CISA guidance on phishing-resistant MFA explains why a stolen password alone should not open an account;
• Separate automatic forwarding from legitimate manual forwarding, then apply data-loss, confidentiality and legal restrictions to both where appropriate;
• Record every exception in the organization's change-management or GRC system and review it at least quarterly.

A forwarding block never evicts a cyberattacker who already controls the account. It also leaves manual data theft, malicious inbox rules that move messages into hidden folders, OAuth consent abuse and unauthorized access through an active session fully available.

The policy belongs inside an account-defense program rather than standing alone as proof that the mailbox is clean. Smaller organizations feel that gap most acutely. According to Verizon's 2026 Data Breach Investigations Report, about 96% of ransomware victims with a known organization size were small or midsize businesses, and these organizations often face unpatched devices, compromised credentials and limited recovery capacity.

Organizations building broader phishing simulations and response workflows can test whether employees and administrators recognize forwarding-related social engineering before a real incident arrives.

2. Monitor Forwarding, Authentication and Mailbox-Rule Activity

Monitoring turns a static policy into a detection control. Alerts should cover new or modified external forwarding settings, inbox rules that redirect or delete messages, sudden mailbox-permission changes, suspicious transport-rule edits and forwarding destinations absent from the organization's approved-domain list.

Context decides which alerts move first. A forwarding rule created immediately after an unusual login, impossible-travel event, unfamiliar device registration, MFA reset or password change requires faster investigation than an approved rule created during a scheduled migration.

Correlating mailbox-audit events with identity-provider logs, application-consent events, endpoint signals and email-delivery records lets analysts separate a legitimate administrator action from a cyberattacker operating through a compromised session.

Scheduled review should run independently of alerting. Executives, finance staff, payroll, legal teams, procurement and shared mailboxes deserve the closest attention because their messages carry payment instructions, contracts, employee records and sensitive negotiations.

Searches should cover rules containing terms such as "forward," "redirect," "delete," "RSS" or "mark as read," alongside neutral-sounding rules that conceal their purpose.

Measurable service levels keep the control honest. A new external forwarding rule deserves investigation within 15 minutes, unapproved forwarding deserves immediate suspension and restoration deserves documented approval.

Alert fidelity should be tested with controlled rule creation and deletion, including activity from administrator accounts, delegated mailboxes, mobile clients and service principals, because a control that works only in the administrator interface misses activity performed through an API or delegated session.

3. Respond to a Discovered Malicious Rule

A malicious forwarding rule is evidence of account compromise. Responders should preserve the rule details, destination address, creation time, actor identity, source IP, user agent, related audit events and affected message range before changing anything.

Then the rule should be disabled or removed, active sessions and refresh tokens revoked, credentials reset and phishing-resistant MFA enrollment required wherever it is not already enforced.

Scoping determines how the cyberattacker entered and what they reached. Sign-in history, OAuth grants, mailbox searches, sent items, deleted items, forwarding logs, delegate permissions and changes to recovery information all belong in that review.

The same destination address, rule pattern, sender impersonation or suspicious login indicators should then be searched for across the organization, and mailboxes that handled payment requests or sensitive data need fraud, legal, privacy and business owners involved before the incident closes.

The account owner deserves notification without blame and a clear recovery path. Employees who report unusual forwarding notices, missing messages or unexpected login prompts give defenders an early signal worth protecting.

After containment, a controlled test should confirm that external automatic forwarding remains blocked, approved exceptions still work, alerts fire and removed sessions cannot reconnect. Without that test, the only evidence the control works is the document describing it.

Unauthorized mailbox rules created in the last hour can forward messages before anyone notices. Adaptive Security combines cloud email security signals with employee reporting so unauthorized forwarding is caught early.

Take a self-guided tour

How Can Security Teams Investigate Phishing Email Forwarding Risks in Microsoft 365 and Google Workspace?

Investigating phishing email forwarding risks means identifying the affected account, preserving mailbox and audit evidence, reconstructing when forwarding began and determining which messages left the organization. Teams should review user-level and administrator-controlled settings, then search sent, received, deleted, archived and quarantined messages before removing every persistence mechanism.

Exact audit operation names and retention periods vary by license, configuration and tenant policy, so the current Microsoft 365 audit documentation and Google Workspace audit and investigation documentation should be checked before relying on a specific query.

1. Collect Evidence Before Changing the Mailbox

Investigations start with the account that reported the suspicious message, the account named in an alert or the mailbox associated with an unexpected external recipient. The record should capture the user's primary address, aliases, delegated accounts, devices, recent sign-in context and suspected destination address.

Timestamps belong in UTC, and relevant records should be exported before any rule is disabled, because changing the setting alters the evidence needed to establish what happened.

Coverage has to span both platforms and both layers. In Microsoft 365, that means mailbox-level forwarding, inbox rules, delegate access, transport or mail-flow rules and applications or automations that can read messages.

In Google Workspace, it means Gmail forwarding, filters, delegation, routing controls and third-party application access. User settings and administrator-controlled policies both need checking, because a cyberattacker who loses one forwarding rule can retain access through a second rule, delegated access, an OAuth grant or a separate routing configuration.

Audit records complete the picture. Searches should cover mailbox-setting changes, rule creation or modification, forwarding changes, authentication events, delegate changes and administrative actions affecting the account, capturing the actor, source device where available, operation, target mailbox, timestamp and result.

Preserving raw exports and query parameters lets another investigator reproduce the findings, and this collection work complements the team's phishing response and email remediation workflow.

2. Reconstruct the Forwarding Timeline

The timeline should be built around the earliest confirmed change in place of the first reported email. Each rule's creation or modification event needs comparing against sign-in records, password-reset activity, MFA changes, suspicious inbox access and the user's reported discovery time.

The exposure window opens when an unauthorized forwarding path becomes active and closes only after the setting is removed, queued messages are handled and active sessions or tokens are revoked where appropriate.

Conditions explain what the timeline actually covers. Investigators should identify the destination address and every condition attached to the forwarding action.

Conditions can limit forwarding to messages from a particular sender, messages containing financial terms, replies to an existing conversation or mail sent to a specific alias, and a narrow condition explains why a mailbox looked normal while sensitive correspondence still left the organization.

Message searches then establish scope. The user's sent, received, deleted, archive and quarantine locations should be searched for correspondence involving invoices, payment instructions, password resets, contracts, identity documents, executive requests and vendor changes.

Comparing message headers, recipients, timestamps and conversation history shows whether the cyberattacker only copied messages or also altered replies. For an external destination, the investigation should establish whether messages contained regulated data, credentials, customer information or confidential business material.

Confirmed exposure and reasonable uncertainty belong in separate records. An audit gap means the investigation cannot establish what happened during that period from available records.

Retention differs across Microsoft 365 and Google Workspace plans, audit configurations, mailbox types and tenant policies, so investigators should verify the affected environment before treating an absent event as evidence that no change occurred.

3. Remove Persistence and Validate Remediation

Remediation has to remove the access path and prove that it stays removed. That means deleting unauthorized forwarding rules and filters, clearing mailbox-level forwarding, removing unknown delegates, reviewing transport or routing rules, revoking suspicious OAuth grants, resetting credentials where compromise is plausible and terminating active sessions under the organization's incident-response procedure.

Stopping after the first rule named in an alert leaves the other paths open.

Validation should combine a separate administrative review with a controlled test message. The review confirms that no external forwarding, hidden filter, delegate, routing policy or application access remains.

The test sends a benign message matching the suspected conditions, then verifies that it stays inside the organization and that the audit trail records the expected result, followed by a fresh search for recent forwarding changes and related sign-ins.

Closure depends on documentation as much as cleanup. Affected recipients need notification, evidence needs preserving under the organization's legal and retention requirements and exposed payment instructions or credentials need escalating to the appropriate fraud and identity teams.

The case record should name the account, destination, conditions, exposure window, affected messages, actions taken and validation result. A ticket closed without a verified timeline leaves the next investigator guessing when the same mailbox appears in another alert.

Close an investigation with evidence rather than assumptions by running phish triage through Adaptive Security, where every reported message keeps its headers, timestamps and attachment structure intact.

Book a demo

What Privacy and Compliance Risks Arise When Phishing Emails Are Forwarded?

Phishing email forwarding risks extend into privacy because a report can reproduce far more information than an analyst needs to classify the cyber threat. The original thread might contain personal data, health information, financial details, customer records, confidential negotiations or other regulated content.

Incident handling therefore has to preserve evidence while limiting unnecessary exposure. NIST SP 800-61 Rev. 3 (April 2025) emphasizes defined procedures for collecting, protecting, analyzing and retaining incident information, which makes forwarding a governance decision as much as an employee convenience.

Why Does a Phishing Report Need Sensitive-Content Controls?

A phishing email rarely arrives as an isolated message. It can include quoted replies, attachments, signatures, customer identifiers, payment instructions, medical details, contract terms, employee records or internal discussions copied from earlier exchanges.

An invoice lure can therefore carry account numbers and vendor data, while a healthcare-related thread can expose protected health information before anyone confirms the message is malicious.

The reporting workflow should apply least-necessary disclosure from the first report. Employees should use the approved reporting mechanism instead of manually forwarding a thread to a broad security alias, copying managers or adding external recipients.

The initial report should capture the signal analysts need, including sender information, headers, links, attachment metadata and the reason the message looks suspicious, while limiting the visible body and attachments when full content serves no investigative purpose.

That distinction protects employees and customers while leaving investigation quality intact. Analysts can request the complete message through a restricted process when classification, scoping, notification or eradication requires it.

Employees should avoid informal redaction, because removing headers, URLs, timestamps or similar details destroys the evidence that establishes how the cyberattack reached the organization.

Cybersecurity awareness training should frame this behavior as a professional reporting skill worth practicing. A short module can teach employees when to use the Phish Alert Button, why a new forwarding chain creates more problems than it solves and how to flag a message that appears to contain sensitive content.

A phish reporting and triage workflow can rehearse that decision through scenarios involving BEC, vendor impersonation and confidential attachments.

How Should Evidence Access and Retention Be Controlled?

Evidence access should follow the investigative purpose. The security team needs enough information to determine whether the message is malicious, identify affected recipients, block related indicators and establish whether data was accessed or disclosed.

Unrestricted access for everyone who can technically open a mailbox exceeds that purpose.

A practical control model separates intake, analysis, escalation and legal review. Automated triage can classify a reported message and route it to trained analysts, while sensitive cases move into a restricted quarantine where access is logged and limited by role.

Analysts should avoid downloading copies to personal devices, pasting message content into unapproved tools or placing attachments in shared collaboration spaces without equivalent access controls.

Retention deserves the same deliberation. The original message, relevant metadata, analyst decisions and remediation record should be kept for the period required by the organization's incident-response policy, contractual duties, regulatory obligations and litigation needs.

Duplicate exports and temporary working files should be deleted once they serve no documented purpose, and a retention schedule should separate operational evidence from records subject to longer preservation requirements.

Legal-hold coordination becomes essential when a phishing event could lead to litigation, regulatory review, an employment matter or a contractual dispute. Security teams should notify legal or compliance through the established escalation path before deleting or altering potentially relevant material.

The legal team decides whether a hold applies and how it changes ordinary retention rules, and an individual analyst should never make that call alone.

Every access and preservation decision should record its investigative purpose. A concise case record can state who accessed the evidence, what question they were answering, which indicators they extracted, what action followed and why the record was retained.

That documentation supports accountability and lets governance, risk and compliance teams separate necessary investigative use from uncontrolled internal distribution.

What Changes for Regulated Organizations?

Regulated organizations face a narrower margin for error because a phishing report can combine security evidence with information governed by privacy, health, financial, payment, employment or customer-record obligations. Suppressing reports or discouraging employees from flagging suspicious messages would trade one risk for a larger one.

The workable answer is a secure reporting path that preserves evidence while controlling who can view it. Sector obligations shape the details. Healthcare teams should anticipate protected health information in patient-related threads and route those cases through approved incident and privacy procedures, while financial services teams account for transaction details, client communications and confidential deal information.

Public-sector, education and professional-services organizations map the workflow to their own records, confidentiality and breach-notification requirements.

No single reporting method satisfies every framework. Compliance depends on surrounding controls, including access restrictions, audit logs, retention schedules, escalation criteria, documented responsibilities and compliance and policy training mapped to the organization's applicable requirements.

GRC leaders should review the phishing workflow with security, privacy, legal, records management, HR and business owners before deployment. The strongest workflow makes safe reporting easier than ad hoc forwarding, which is measurable: fewer copies of the original message exist afterward, and every copy that does exist has a named owner and an access log.

How Should Organizations Test and Measure Defenses Against Phishing Email Forwarding Risks?

Phishing email forwarding risks become measurable once organizations test the full chain, from an employee's first report through mailbox-rule detection to final remediation. Authorized phishing simulations, controlled mailbox-rule tests, tabletop exercises and narrowly scoped adversary-emulation activities belong in separate environments with separate authorization.

Programs should track behavioral improvement and response speed alongside completion percentages, then use each result to refine controls and repeat the test.

1. Design an Authorized, End-to-End Test

Testing starts with a written plan that names the owner, scope, dates, systems, employee groups, success criteria and emergency stop procedure. Security operations, identity, messaging, legal, HR and help desk teams all need notice before testing begins.

The objective is to measure defensive behavior without creating confusion that resembles a real incident.

A safe phishing simulation should mirror the forwarding scenario under evaluation. A controlled message with a suspicious attachment or link, paired with an instruction to report it through the approved Phish Alert Button, tests the behavior that matters.

Live malware, real credential collection, external command-and-control infrastructure and personal data have no place in that exercise. The reporting workflow should preserve the original message, headers and attachment so analysts can judge whether the process actually supports investigation.

Technical controls deserve separate testing from employee judgment. A benign mailbox-rule scenario in an approved test mailbox verifies whether security teams detect rules that automatically forward messages externally, hide incoming mail or redirect finance and executive communications.

The test must not affect production mail flow or send confidential information outside the organization.

Endpoint and identity telemetry testing needs tighter authorization still. Atomic Red Team's adversary-emulation documentation applies only in an approved lab, test tenant or explicitly authorized production window.

Teams should select tests that validate logging and alerting for mailbox, identity or script activity, document every command and obtain written authorization before execution. Adversary emulation validates whether defensive systems produce and route useful signals, while the phishing simulation validates whether people recognize and report the lure.

2. Measure Reporting Behavior and Control Performance

A baseline has to exist before the exercise launches. A high report rate proves little when employees report only after forwarding the message, omit the attachment or wait until another person raises the alarm.

The measurement should follow the sequence from delivery to report, triage, containment and recovery.

These outcomes deserve tracking for each exercise:

• Report rate: The percentage of recipients who report the phishing simulation through the approved channel;
• Median reporting time: The middle elapsed time between delivery and reporting, showing whether employees act quickly under pressure;
• Attachment-preservation rate: The percentage of reports that retain the original attachment, headers and relevant message context;
• False-positive rate: The percentage of reported benign messages classified as malicious, showing whether reporting creates avoidable analyst workload;
• Forwarding-rule detection time: The time between creation of a suspicious mailbox rule and its detection by monitoring or analysts;
• Exposure duration: The time a malicious or simulated rule stays active before disablement and review;
• Remediation time: The elapsed time from confirmed detection to message recall, rule removal, account protection and employee notification;
• Repeat behavior: The percentage of participants who repeat the same unsafe action in a later exercise, such as forwarding the message without reporting it.

Segmentation gives those numbers meaning. Results should be broken out by department, role, channel and scenario, since finance employees handling payment requests need different tests from developers receiving fake repository notifications.

Comparing each person's behavior with prior results should direct coaching rather than public comparison.

Completion percentages measure attendance and nothing more. As NIST computer scientist Julie Haney and University of Maryland Associate Professor Wayne Lutters concluded in their peer-reviewed analysis published in Computer (October 2020), compliance metrics do not tell the whole story and fail to measure the effectiveness of the program in a sustained change in employee attitudes and behaviors.

A rising report rate paired with faster reporting and fewer repeated errors demonstrates stronger behavioral change, and a unified phishing simulation program can connect those results to role-specific exercises.

3. Convert Findings Into Remediation and Retesting

Every exercise should close with a short tabletop discussion involving the people who would handle a real forwarded phishing email. CISA's Tabletop Exercise Packages provide adaptable structures for assigning roles, introducing new facts and testing decisions.

A useful sequence presents an employee report, a preserved attachment, a newly discovered forwarding rule and evidence that an executive mailbox has been exposed.

The discussion should stay operational, naming who validates the report, who searches for matching messages, who disables the rule, who decides whether credentials require a reset and who approves external notification. The exercise exists to expose ownership gaps before a cyberattacker finds them, and each gap should be recorded as an action with an owner, due date, severity and retest condition.

Remediation might tighten external-forwarding alerts, preserve attachments in the reporting workflow, change mailbox-rule permissions, add targeted cybersecurity awareness training or clarify escalation paths. A published policy is the start of the fix instead of its conclusion.

Findings should close only after a repeat test shows faster detection, shorter exposure, better evidence preservation or fewer repeated unsafe actions. At that point the exercise has produced something a reviewer can see: a shorter gap between rule creation and detection, recorded twice.

Completion percentages hide how long a real report waits for triage. Adaptive Security measures reporting speed, evidence quality and repeat behavior across every phishing simulation it runs.

Take a self-guided tour

How Email Reporting Reduces Phishing Email Forwarding Risks

Phishing email forwarding risks sit inside a broader human risk problem. An employee who forwards a suspicious message without context can spread malicious links, expose sensitive headers or lead colleagues to trust the lure.

CISA's phishing guidance treats rapid reporting as a core defensive behavior, and effective reporting has to cover more than email because cyberattackers move freely across trusted channels. The strongest cybersecurity awareness training programs make reporting simple, practice it continuously and interpret the resulting behavior without turning employees into targets of blame.

Why Is Reporting a Useful Behavioral Signal?

Reporting shows what employees do under pressure, beyond what they remember after completing a course. A forwarded phishing email can indicate that an employee recognized something unusual, and it can equally reveal uncertainty about the correct reporting path.

Security teams should separate those outcomes so they reinforce sound judgment without discouraging future reports.

A low-friction process gives employees one clear action for suspicious email, such as a report button or designated mailbox, followed by confirmation that explains what happens next. Certainty that a message is malicious should never be a prerequisite for reporting it.

CISA's phishing guidance recommends reporting suspicious messages and activity, including situations where a user already opened a link or attachment.

Reporting data becomes more useful when security teams combine it with other signals:

• Phishing simulation outcomes: Whether an employee clicked, entered credentials, opened an attachment or reported the message;
• Cybersecurity awareness training behavior: Completion, assessment performance and whether assigned refreshers were finished after a risky action;
• Role and exposure: Finance teams, executive assistants, help desk staff and administrators face different social engineering patterns and access levels;
• Response time: How quickly an employee reported the message and whether the report arrived before anyone acted on it;
• Channel coverage: Whether the employee recognizes related attempts through email, SMS, voice, collaboration tools or video calls.

That combined view keeps one forwarded message from becoming a simplistic risk label. An employee who reports a suspicious invoice within two minutes, even after opening it, needs rapid coaching, while a team that repeatedly forwards malicious messages without touching the reporting path needs clearer practice and better workflow design.

How Should Cybersecurity Awareness Training Extend Beyond Email?

Email reporting alone cannot prepare employees for every form of social engineering, because the same deception often continues through another channel. AI-generated spear phishing can begin with a personalized email, move to a vishing call using a cloned executive voice and end with a request to approve a payment.

BEC can imitate a supplier or senior leader, while smishing can direct an employee to a fake login page on a personal phone.

Synthetic media has accelerated that pattern. According to Sumsub's Identity Fraud Report 2024, deepfake fraud incidents grew 4 times year-over-year.

A deepfake video call can manufacture visual confirmation, and QR-based attempts bypass familiar link inspection habits by moving the interaction from a managed computer to a personal device. Cybersecurity awareness training must address these channels together so employees recognize the underlying manipulation across every format it arrives in.

Training should rehearse the decision as well as the message format, so employees practice pausing when a request combines urgency, authority and secrecy. They should know how to verify a payment change through a trusted channel, report a suspicious text without replying and escalate a voice or video impersonation even when the request appears to come from a familiar person.

Role-specific practice makes those behaviors practical. Finance teams can rehearse vendor-payment requests and invoice changes, executives and assistants can practice identity verification during urgent calls, customer support teams can handle account-recovery requests and technical staff can examine QR codes and credential prompts.

Continuous multi-channel phishing simulation practice turns reporting from a compliance instruction into a repeatable response under realistic conditions. Privacy has to stay part of that design, so human risk programs should collect only the data needed to understand exposure, behavior and improvement, restrict access to individual results and explain how findings are used.

How Should Leadership Oversee Phishing Email Forwarding Risks?

Board and executive oversight determines whether reporting workflows receive funding, staffing and authority. A mailbox-rule alert that reaches an analyst days late can point to an ownership gap at leadership level.

Regular reporting to the board turns phishing email forwarding risks into a governance item with a named owner instead of an operational footnote.

Engaged boards correlate with stronger outcomes. According to the World Economic Forum's 2026 Global Cybersecurity Outlook, 52% of highly resilient organizations indicate that board members receive regular cybersecurity updates, and 48% report that board members are actively engaged with cybersecurity issues.

Organizations should give directors a short, consistent view of reporting speed, forwarding-rule detection time and unresolved exceptions to the external forwarding policy.

Accountability changes behavior at the top as well. According to the World Economic Forum's 2026 Global Cybersecurity Outlook, 30% of highly resilient organizations reported that board members hold personal liability in the event of cyber breaches, compared with 9% of organizations with insufficient resilience.

That liability makes the governance questions concrete: who approves forwarding exceptions, who reviews them quarterly and who answers for an exposure window that stayed open for a month.

Leadership attention also has to reach emerging channels. According to the National Cybersecurity Alliance's 2025–2026 Oh Behave! The Annual Cybersecurity Attitudes and Behaviors Report, 52% of employed participants reported they have not received any training on the security or privacy risks of AI tools, despite 65% now using AI and 43% admitting to sharing sensitive work information with AI tools.

Sensitive email pasted into an unapproved assistant creates the same disclosure problem as an unauthorized forward, which is why AI governance and email reporting belong in the same oversight conversation.

Annual modules measure attendance while cyberattackers measure hesitation. Adaptive Security runs continuous phishing simulations across email, SMS, voice and video so reporting becomes a practiced reflex rather than a decision.

Explore the platform

Strengthen Reporting Against Phishing Email Forwarding Risks With Adaptive Security

Many organizations tell employees not to forward suspicious email, yet forwarding stays tempting whenever it is the fastest available action. Adaptive Security closes that gap by making the controlled report the path of least resistance, then turning each report into a classified case with its headers, attachments and delivery context preserved for investigation.

Detection and reporting reinforce each other when they share a signal. Cloud Email Security applies behavioral analysis, intent analysis and LLM reasoning to inbound mail through an API integration that requires no MX record changes, quarantining malicious messages before employees see them.

Behavior change completes the loop. Every detected message connects to the employee it targeted and assigns role-relevant cybersecurity awareness training, while compliance and policy training maps that practice to the privacy and retention obligations that govern how a phishing report is handled.

Employees choose forwarding whenever reporting takes more effort. Adaptive Security makes the controlled report the fastest available action and ties each one to role-based cybersecurity awareness training.

Take a self-guided tour

Frequently Asked Questions About Phishing Email Forwarding Risks

Is It Safe to Forward a Phishing Email to IT or Security?

Yes, forwarding a phishing email to IT or security is safe when it travels through the organization's approved reporting channel and nobody opens links or attachments along the way. A built-in Report phishing control is usually preferable because it submits the message without redistributing its contents. Where the process requires forwarding, the original should be sent as an attachment with the recipient, approximate time, device used and any interaction described in the covering message. Suspicious email should never reach coworkers or external contacts, and no credentials should ever be entered to "verify" a report.

Why Should a Phishing Email Be Forwarded as an Attachment Instead of Normally?

A phishing email should be forwarded as an attachment because the method preserves more original evidence and limits accidental interaction with the message body. Analysts can then inspect headers, timestamps, routing details, authentication results, links and attachments with less alteration to the source message. The original copy should stay unedited and unsanitized, and it should travel only through the designated secure reporting route.

Can Forwarding a Phishing Email Expose Recipients to Malicious Links, Attachments or Tracking Content?

Yes, forwarding a phishing email can expose recipients to malicious links, attachments, QR codes, active HTML and tracking content. Forwarding itself rarely executes an attachment, and a recipient can still click, open, scan or reply to the redistributed message. Remote content can also generate network requests that reveal limited device or recipient information. An approved reporting button or an attachment sent to IT handles the report without circulating the message for informal review.

What Should an Employee Do After Accidentally Clicking a Phishing Email Link or Opening Its Attachment?

An employee who clicked a phishing link or opened its attachment should stop interacting with the message, contact IT or security immediately and report exactly what happened. Closing the page, isolating the device where malware activity appears and changing any exposed password from a known-safe device all limit the damage. Government of Canada guidance identifies links and attachments as common malicious-email hazards. Prompt reporting gives responders the clearest path to contain access and protect other people.

How Can Administrators Detect a Malicious Email Forwarding Rule?

Administrators can detect a malicious email forwarding rule by auditing mailbox-rule changes, external forwarding settings, destination addresses, conditions and related sign-in activity. Alerts should fire on newly created or modified rules that forward messages outside the organization, target finance or executive mail, mark messages as read or move them out of view.

Suspicious messages can take hours to reach an analyst. Adaptive Security shortens that path to one click and keeps the original evidence intact for the investigation that follows.

Book a demo