Reporting Suspected Spam or Phishing Emails

This article explains the correct way to report suspicious emails and why inline forwarding should be avoided.

If you receive a message that appears to be suspicious, spam, or phishing-related, please report it as soon as possible.

Recommended Reporting Method

The preferred way to report suspicious messages is by using the Barracuda Add-in in Outlook. This also sends a notification to the Cybersecurity Team and may help speed up our response time when action is needed, such as message removal.

Outlook Web Client:

Outlook Desktop Client:

If prompted, you may need to authorize the Add-in before it can be used.

Contacting the Help Desk

Users should still contact the Help Desk about potentially harmful messages. Email forwarding is acceptable only if it is done correctly.

How to Forward a Suspicious Message Correctly

Do not forward the message inline using the original email thread.

Instead:

1. Create a new email message

2. Use a generic subject line, such as:

   • Suspected Spam

   • Suspicious Message

3. Drag and drop the suspicious email into the new message so it is included as an attachment

4. Keep any written details brief, or contact the Help Desk separately by phone with additional information

Why Inline Forwarding Should Be Avoided

Forwarding suspicious messages inline creates several issues:

1. Important header information is lost

When a suspicious email is forwarded inline, the full message headers are often removed. These headers are important for reviewing and investigating the message. Sending the email as an attachment preserves this information.

2. It can interfere with message removal efforts

When malicious messages need to be removed from inboxes, the original subject line is often used to identify them. If a suspicious email is forwarded inline, the forwarded copy usually contains the same subject line.

This can create two problems:

• It may be difficult to distinguish the original malicious message from legitimate follow-up emails

• Legitimate messages in the email chain, including replies between the user and the Help Desk, may also be removed during cleanup

In some cases, email addresses involved in the message chain could also be unintentionally blocked as part of the remediation process. While these issues can be reviewed and corrected, doing so takes additional time and may delay resolution.

Best Practice

To help us investigate and respond efficiently:

• Use the Barracuda Add-in in Outlook whenever possible

• If emailing the Help Desk, send the suspicious message as an attachment

• Do not forward the message inline

• Keep your email comments brief

 

For questions or assistance, please contact the Help Desk at 909-652-6789 or ISRepairs@chaffey.edu.