Let staff report a suspicious call

Share the public report link with staff, turn a matching test call into a Reported result, and get an email when a report matches no test.

Every workspace has one public page where staff report a suspicious call. No login is needed. When the call was one of your tests, the person’s result becomes Reported, the best outcome. When it was not, your security contact gets an email about a possible real attack.

You need the Member role or above to see the link. Anyone with the link can use the report page.

​

Before you start

• Somewhere to publish the link to staff: your intranet, a poster, or the awareness email you send before a programme.
• The email address of the person who should hear about possible real attacks.

​

Steps

1. Open Fair testing

   In the console, open Red Team, then the settings page titled Fair testing. Its address is /red-team/settings. Scroll to Report a suspicious call.

2. Copy and share the link

   The link is shown in the box. Click Copy. Share it with staff in whatever way they will find it when they need it. The address ends in a long random token, so it cannot be guessed.

3. Set the security contact

   Under Security contact email, enter the address that should receive alerts about possible real attacks. Leave it empty and the alert goes to the workspace owner. Click Save settings.

4. Rotate the link when you need to

   Click New link to make a new one. A window asks you to confirm, because the old link stops working straight away. Share the new link with staff.

​

What staff see

The page is titled Report a suspicious call. It says: “Got a call that felt wrong? Tell us. It takes a minute and it helps everyone.”

Field	Required	Help text on the page
Number that called you	Yes	As it showed on your phone. “Withheld” or “unknown” is fine too: type that.
When did it happen?	Yes	Roughly is fine. We match to the nearest half hour.
Your number (optional)	No	Helps us match the call when the caller’s number was hidden.
What happened? (optional)	No	Who they said they were, what they asked for.
Your name or extension (optional)	No	Only your security team sees this, and only if the call was not one of our tests.

The button is Send report. Under it: “You will not be judged for reporting. Reporting a call is always the right call.”

​

What happens next

DeepBlocker looks for one of your test calls within 30 minutes of the time given. A call matches when its caller number is the number reported, or when its dialled number is the person’s own number. Only campaigns active around that time are checked. Reports older than 30 days cannot be matched.

Result	What the person sees	What you see
A test call matched	”That call was part of a planned security exercise run by your organisation. Reporting it was exactly the right thing to do, and it has been recorded in your favour.”	The person’s verdict becomes Reported. The Why column says how many minutes after the call started. If they had given something away first, it says so. See Read your results.
Nothing matched	”Your report has been passed to your security team, who will look into it. If the caller asked you to do something, such as share a code, move money or install software, please do not do it until security has confirmed it is safe.”	An email to your security contact with the subject Possible real vishing attack reported by a member of staff. It lists the number, the time, the person’s number and note if given, how many test calls were checked, and a report reference.

Nothing about who was called ever goes back to the browser. The page only learns “matched” or “not matched”.

The best-prepared teams add the link to the warm-up notice or the awareness email, so the way to report is in the person’s hand before the call comes.

​

Problems

The page says This report link is not valid

The link was rotated, or it was copied with a character missing. Copy it again from Fair testing and share the new one.

The page says Too many reports from this network in a short time

The page limits how many reports one network can send in a few minutes. Wait a few minutes and try again.

A real test was reported but the result still says Failed

The time given was more than 30 minutes from the call, or the number did not match. Ask the person to report again with their own number filled in, which lets the match use the dialled number.

No alert email arrived for an unmatched report

Check Security contact email on Fair testing. When it is empty, the alert goes to the workspace owner’s address.