Why Your Report Makes a Difference
Our Security Operations Center is instantly notified of the threat.
Zero-Hour Auto Purge removes the same threat from every CMC inbox automatically.
Malicious links and attachments are blocked at the network level.
Trend data helps ITS proactively defend against future attacks targeting CMC.
Before You Begin
- The suspicious email is still in your inbox (don't delete it before reporting)
- Outlook desktop app or Outlook on the web (www.cmc.edu/mail)
- Do NOT forward the email to anyone — use the Report button only
Open the Suspicious Email in Outlook
Open the email you want to report in Outlook desktop or Outlook on the web (www.cmc.edu/mail). Do not click any links or open any attachments inside the email.
Find the "Report Phishing" Button
The location differs slightly between Outlook versions:
- Outlook desktop: Look in the Message tab in the ribbon at the top — find the "Report" or "Report Phishing" button
- Outlook on the web: Look for the three-dot menu (…) or "Report Phishing" button in the email toolbar at the top of the message
Select "Phishing" from the Options
When you click "Report Phishing," you'll see options such as Junk, Phishing, and Not Junk. Select Phishing. This sends the full email with headers to Microsoft's security team and simultaneously notifies CMC's Security Operations Center.
Confirm and Delete
You'll see a brief confirmation message. After confirming the report, delete the email from your inbox and then empty your Trash/Deleted Items folder to fully remove it from your mailbox.
Common Phishing Red Flags
Urgent Language
"Your account will be closed," "Immediate action required," "Verify now or lose access"
Suspicious Sender
Email addresses that resemble CMC addresses but have subtle differences or unexpected domains
Unexpected Attachments
Especially .zip, .exe, or macro-enabled Office documents (.docm, .xlsm)
Mismatched Links
Hover over links before clicking — do they go where they claim? Mismatched URLs are a major warning sign.
Gift Card / Money Requests
"Please buy $500 in Apple gift cards and send me the codes" — a classic scam targeting students and staff
Unsolicited Job Offers
Vague job offers with high pay and minimal requirements sent via email are common phishing vectors
What NOT to Do
- Do not click any links inside the suspicious email
- Do not open any attachments
- Do not reply to the sender
- Do not forward the email to colleagues or the Help Desk — use the Report button
- Do not ignore it — even if you think it's harmless, reporting helps protect everyone
For Faculty & Staff: Phishing Simulation Training
The Security Operations Center offers free phishing simulation training and awareness sessions for departments. These simulations help your team recognize and respond to real attacks. Contact the Help Desk to schedule a session for your department.
Schedule a Training Session