Pause before responding

An unexpected request, unusual link, unfamiliar attachment, or pressure to act quickly is a reason to verify—not proof by itself that a message is malicious.

Check whether the sender and request make sense in context. Be cautious if a message asks for a password, one-time code, payment, sensitive information, or an unusual change to a normal process. Do not use contact details or links in a message you are trying to verify.

Northstar's exact reporting route is an organization-specific setup item. Confirm and publish that route before using this page as reporting instructions.

If a message seems suspicious

Use Northstar's confirmed reporting process; do not forward a suspicious message unless that process specifically tells you to.

  1. 1

    Pause

    Do not reply, follow links, open attachments, or provide information while you check the request.

  2. 2

    Verify through a trusted route

    If the request appears to come from someone you know, contact them using a work channel or details you already trust—not details supplied in the message.

  3. 3

    Report using the approved route

    Use Northstar's confirmed message-reporting process. Do not guess at an address, button, or app destination.

  4. 4

    Ask for help if unsure

    Use your organization's established security or IT support route. If you already clicked, replied, or shared information, report that promptly through the confirmed route.

Training is not the reporting route

Use the Training app for assigned phishing learning; use Northstar's approved process to report a real suspicious message.

Check Training for an assigned phishing course or exercise.

For a real suspicious message, follow the confirmed reporting process—not a course or this page.