Thank the Person Who Clicked
Holiday scam season is here. Fake delivery notices, gift card requests, deals that look too good to be true. Consumer safety groups, including the National Cybersecurity Alliance, have already put out their seasonal warnings. Those same messages land on work phones and in work inboxes.
Some of your people will click. Plan for it.
The click isn't the failure. Silence is.
Training lowers the odds. It never takes them to zero. A good lure on a busy afternoon catches careful people. What decides how bad the day gets is what happens next.
In the first minutes after a click, your team can still reset a password, end a session, block a sender and pull the same message out of every other inbox. Wait a day and you're running an incident. You only get those minutes if the person who clicked tells someone. And people don't report what they expect to be punished for.
Make reporting the easy thing
One report button in email. One number or chat channel for phones. Same answer everywhere.
Put it where people will see it: onboarding, the intranet, the bottom of every security reminder.
Take reports of anything odd: texts, calls, QR codes, pop-ups. Not just email.
No forms. A forward or a one-line message is enough.
Respond like you want another report
Answer every report fast, even if the answer is "safe, thanks."
When someone says "I clicked," your first words are "thank you." Then the questions.
Fix the account first. Ask how it happened later.
Never shame anyone by name. Not in a meeting, not in a newsletter, not after a phishing test.
Close the loop. Tell the reporter what you found.
Measure the right thing
Click rates tell you how good the lure was. Report rates tell you how good your culture is. Track these instead:
How many people reported a test or real campaign
Minutes from first delivery to first report
How many "I clicked" reports came in on their own
Then share the wins: "A report this morning stopped a fake invoice before anyone else opened it." Stories travel further than slide decks.
Leaders go first
If an executive reports a suspicious message, say so, with their permission. If a leader clicks, they report it like anyone else. People copy what the boss does, not what the policy says.
Your 15-minute drill this week
Use your own report button. Time how long it takes a human to answer.
Ask three people: "If you clicked something bad, who would you tell?" Count how many different answers you get.
Agree on one sentence for every "I clicked" call: "Thank you for telling us. Let's fix it."
People repeat what gets rewarded. Reward the report. That's tactical to practical.
When someone on your team clicks, do they call you first, or hope nobody notices?
Views are my own.
Comments