# Reply to an employee who reported a phishing email

Writes a short, encouraging reply to someone who reported a suspicious email, tailored to whether they clicked.

- Topic: Email & Workplace Communication
- Framework: Few-Shot
- Level: Standard
- Tags: Communication, Email, HR & Hiring, Write, Fill-in Template
- Source: https://www.thinkwithprompt.com/prompts/reply-to-an-employee-who-reported-a-phishing-email

## Prompt

```text
Write a reply to an employee who reported a suspicious email.

**Employee's first name:** [NAME]
**Our verdict:** [phishing / legitimate / simulation test / still checking]
**What they did:** [only reported it / clicked the link / entered their password / opened the attachment / replied]
**Actions we already took:** [e.g. "reset your password", "removed it from all inboxes"]
**What they need to do now, if anything:** [e.g. "sign in again on your phone", "nothing"]
**Tone and channel:** [email / Teams or Slack message]

Requirements:
- Start by thanking them. Reporting is the behavior we want more of, even when they clicked first.
- Never blame or shame them. If they clicked, say plainly that reporting fast limited the damage.
- If it was legitimate, thank them anyway and explain in one sentence why it was safe, so they keep reporting.
- If they must do something, put each step on its own numbered line with a deadline in bold.
- Point out 1-2 specific red flags from this email they can spot next time.
- Under 120 words. No jargon (no "DKIM", "IOC", "payload").

Return the message plus a two-sentence version for chat.
```

## What to fill in

- NAME
- phishing / legitimate / simulation test / still checking
- e.g. "reset your password", "removed it from all inboxes"
- e.g. "sign in again on your phone", "nothing"
- email / Teams or Slack message

Free to copy and use. From ThinkWithPrompt (https://www.thinkwithprompt.com/), a library of 2,663 curated AI prompts.