"I didn't click": What users say when reporting phishing

Key finding

People who report suspected phishing typically describe evidence they noticed, possible impacts, what they did or did not do, and questions they have. Some build clear arguments for why the email is phishing and why the organization should act.

Why it matters

Shows reporters are active, reasoning agents who want answers, supporting fast two-way feedback on reports.

Informs

• Reports suspicious messages context
• Reports their own mistakes quickly context
• Answers every report with fast, positive feedback supports

Cite

Pilavakis, N., Jenkins, A., Kökciyan, N., & Vaniea, K. (2023). "I didn't click": What users say when reporting phishing. Proceedings 2023 Symposium on Usable Security (USEC 2023). https://doi.org/10.14722/usec.2023.233129