Unwanted and malicious email messages are a fact of life for any email user, especially in higher education.  While it is important to be able to recognize spam and phishing email messages, equally important is knowing what to do with them once you have identified them.  This KB will outline the process that the UW-Madison Office of Cybersecurity wants users to follow once they have identified unwanted email.  Properly reporting spam and phishing email helps both the Office of Cybersecurity and the campus email team track down the sender of the message and improve message filtering.

Some Definitions

• Spam email is generally unsolicited and unwanted email.  It is equivalent to "junk mail" that you usually receive via the US Post office at home.  They usually take the form of (but are not limited to) ads for goods or services, announcements that are unrelated to your profession or campus activities, or requests to purchase things such as gifts cards.  They are generally harmless, but a nuisance nevertheless.
• Phishing email is an active attempt to steal personal or sensitive data such as login credentials or credit card information.  There are a variety of ways in which an attacker can create such a message.  Please refer to "Learn how to recognize and report phishing - UW–⁠Madison Information Technology (wisc.edu)" for information on identifying phishing email.

Reporting Spam/Phishing Messages

It is important that you follow these steps when reporting a message as spam or phishing.  This process will forward the message to Cybersecurity and the email team with the necessary information they need to analyze and trace it.  Simply forwarding a copy of the message using your email "forward" command is not enough.

NOTE: Beginning Tuesday, May 16, 2023, the UW-Madison “Report Spam/Phish” Outlook add-in was replaced with a Proofpoint “Report Suspicious” add-in.  We updated this article to reflect that.  If you still see the "Report Spam/Phish" option in the Outlook app or web client, try restarting.  If it persists, please contact the school's help desk at helpdesk@pharmacy.wisc.edu.

Using the Outlook Email Client - Windows/Mac

1. Make sure that you have opened the "Home" tab in your Outlook ribbon.
   
   
   
2. Double-click the message to open it in a separate window, or at least make sure that you can read it in the Reading Pane.
   
   
3. On the far right of the Ribbon in the Home tab, click the "Report Suspicious" category.
   
4. Outlook will send a copy of the message to Cybersecurity and then delete the message.  You should see a pop-up box confirming that action.  Once you click "Close", Outlook will move the message to your "Deleted" folder.  That may take a few seconds, so please be patient.
   

Using the O365 Web Client

If you do not use the MS Outlook email client, or you are using Outlook on a phone or tablet, please use a browser to log into https://my.wisc.edu with your NetID credentials, and open the "Email" app to use the O365 web client.

1. Once you are in O365 using a browser, click on the spam/phishing email in the message list to open it in the reading pane, or double click on it to open it in a separate window.
   
   
2.  In the upper-right corner of the message pane (or separate window), click on the three horizontal dots (the "More Options" menu).
   
3. In the pop up menu, scroll down to look for "Report Suspicious".
   
   
   
4. Click "Report Suspicious".
   
   
5. Outlook will send a copy of the message to Cybersecurity and then delete the message.  You should see a pop-up box confirming that action.  Once you click "Close", Outlook will move the message to your "Deleted" folder.  That may take a few seconds, so please be patient.
   

The biggest gain with this new method is that you don't have to decide whether to report a message as spam or phishing.  Clicking "Report Suspicious" is all you need to do!

If you need any help determining if a message is spam or phishing, or help reporting it, please contact IIT support at helpdesk@pharmacy.wisc.edu.