Cybersecurity Foundations (Grades 6–8) · lesson 33 of 48 · 10 min
Reporting Is an Active Defence — Not Just a Button
Most people think of cybersecurity as something that happens to them — attacks, breaches, infections. But you have an active role to play. When you report suspicious content, you are not just protecting yourself — you are protecting everyone who might encounter the same threat after you.
Platforms, schools, and law enforcement all rely on user reports to identify and remove threats. A single phishing report can trigger takedowns that protect thousands of other users. Knowing how and where to report is a practical skill every digital citizen needs.
By the end of this lesson you will be able to identify what to report and to whom, follow the correct reporting procedure for phishing emails and suspicious content, understand responsible disclosure for security vulnerabilities, and know when to involve IT staff or law enforcement.
The power of one report
In 2021, a single user’s report to Google’s Safe Browsing team led to the takedown of a phishing campaign that had already targeted 14,000 Gmail users. Google’s automated systems had missed it, but a human report triggered a manual review. Your report matters — platforms cannot catch everything automatically.
Why Reporting Matters
Cybersecurity is not just about defending your own device — it is about protecting the community. When you encounter suspicious content online — a phishing email, a fake account, a scam post, or harmful material — reporting it is one of the most effective actions you can take.
Platforms, schools, and law enforcement all rely on user reports to identify and remove threats. A single report can protect thousands of other users from the same attack.
What to Report and Where
How to Report Effectively
A good report gives investigators enough information to act. When reporting suspicious content, try to include:
Reporting at School
Schools have specific reporting channels for cybersecurity incidents. Knowing these in advance means you can act quickly when something happens:
Responsible disclosure
If you discover a security vulnerability — in a school system, a website, or an app — the ethical approach is responsible disclosure: report it privately to the organisation so they can fix it before it is exploited. Do not post it publicly or exploit it yourself. Many organisations have bug bounty programmes that reward responsible disclosure.
How to report a phishing email — step by step
Do NOT click any links Before doing anything else, make sure you have not clicked any links or downloaded any attachments in the email. Take a screenshot Capture the full email including the sender address, subject line, and body. This preserves evidence in case the account is deleted after your report. Use the built-in report button In Gmail: click the three-dot menu → “Report phishing”. In Outlook: click “Report” → “Report phishing”. This trains the spam filter and alerts the provider. Forward to anti-phishing organisations Forward the email to reportphishing@apwg.org (Anti-Phishing Working Group). This helps protect others globally. Notify your school IT department If the email arrived at your school account, tell IT immediately. They can check if others received the same email and block the sender. Delete the email After reporting, delete the email from your inbox and trash. Do not leave it where you might accidentally click it later.
Knowledge Check
Reporting Suspicious Content
You receive a phishing email. What should you do first?
- Reply asking who sent it
- Click the link to see if it is real
- Take a screenshot and report it using your email provider’s phishing button
- Forward it to all your friends to warn them
Answer: Take a screenshot and report it using your email provider’s phishing button
Screenshot first (the content may be removed), then report. Never click links or reply — this confirms your account is active.
You accidentally click a suspicious link on a school laptop. What should you do immediately?
- Close the browser and hope nothing happened
- Tell the IT department so they can check for infection
- Delete your browsing history
- Restart the computer
Answer: Tell the IT department so they can check for infection
IT staff can run scans, check network logs, and contain any infection before it spreads. Immediate reporting limits damage.
Forwarding a suspicious email to friends to warn them is a safe way to help.
- True
- False
Answer: False
Forwarding spreads the threat. Your friends may click the link. Report to the platform and IT department instead.
What is responsible disclosure?
- Posting a vulnerability publicly to warn users
- Exploiting a vulnerability to prove it is real
- Reporting a vulnerability privately to the organisation so they can fix it
- Ignoring a vulnerability because it is not your problem
Answer: Reporting a vulnerability privately to the organisation so they can fix it
Responsible disclosure gives the organisation time to patch the vulnerability before attackers can exploit it. Public disclosure before a patch is available puts users at risk.
When reporting suspicious content, you should take a _____ before reporting in case the content is removed.
Answer: screenshot
Platforms often remove reported content quickly. A screenshot preserves evidence for investigators.
Real-World Case Studies
Case 1: The IC3 — How Reporting Leads to Arrests
The FBI’s Internet Crime Complaint Center (IC3) receives over 800,000 cybercrime reports per year. These reports directly lead to investigations and arrests. In 2021, IC3 reports contributed to the arrest of a Nigerian national who had defrauded over 100 US businesses of $6 million through Business Email Compromise (BEC) attacks. Without victim reports, investigators would have had no starting point. The lesson: reporting to the right authority (IC3 for financial cybercrime, FBI for serious incidents) creates a paper trail that enables prosecution.
Case 2: Responsible Disclosure — The Google Bug Bounty
In 2021, a security researcher discovered a critical vulnerability in Google Chrome that could allow attackers to execute arbitrary code. Instead of selling it on the dark web (where it could fetch $500,000+), the researcher reported it to Google through their Vulnerability Reward Program. Google patched it within 7 days and paid the researcher $20,000. The lesson: responsible disclosure protects millions of users and is increasingly rewarded financially. Many major companies pay bug bounties — ethical hacking and responsible disclosure is a legitimate career path.
Previous lesson: Recognizing misinformation
Back to Cybersecurity Foundations (Grades 6–8)
Next lesson: Security updates explained