> ## Documentation Index
> Fetch the complete documentation index at: https://docs.deepblocker.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Let staff report a suspicious call

> Share the public report link with staff, turn a matching test call into a Reported result, and get an email when a report matches no test.

Every workspace has one public page where staff report a suspicious call. No login is needed. When the call was one of your tests, the person's result becomes **Reported**, the best outcome. When it was not, your security contact gets an email about a possible real attack.

> [!NOTE]
>
> You need the Member role or above to see the link. Anyone with the link can use the report page.

## Before you start

* Somewhere to publish the link to staff: your intranet, a poster, or the awareness email you send before a programme.
* The email address of the person who should hear about possible real attacks.

## Steps

**1. Open Fair testing**

In the console, open **Red Team**, then the settings page titled **Fair testing**. Its address is `/red-team/settings`. Scroll to **Report a suspicious call**.

**2. Copy and share the link**

The link is shown in the box. Click **Copy**. Share it with staff in whatever way they will find it when they need it. The address ends in a long random token, so it cannot be guessed.

**3. Set the security contact**

Under **Security contact email**, enter the address that should receive alerts about possible real attacks. Leave it empty and the alert goes to the workspace owner. Click **Save settings**.

**4. Rotate the link when you need to**

Click **New link** to make a new one. A window asks you to confirm, because the old link stops working straight away. Share the new link with staff.

## What staff see

The page is titled **Report a suspicious call**. It says: "Got a call that felt wrong? Tell us. It takes a minute and it helps everyone."

| Field | Required | Help text on the page |
| - | - | - |
| **Number that called you** | Yes | As it showed on your phone. "Withheld" or "unknown" is fine too: type that. |
| **When did it happen?** | Yes | Roughly is fine. We match to the nearest half hour. |
| **Your number (optional)** | No | Helps us match the call when the caller's number was hidden. |
| **What happened? (optional)** | No | Who they said they were, what they asked for. |
| **Your name or extension (optional)** | No | Only your security team sees this, and only if the call was not one of our tests. |

The button is **Send report**. Under it: "You will not be judged for reporting. Reporting a call is always the right call."

## What happens next

DeepBlocker looks for one of your test calls within 30 minutes of the time given. A call matches when its caller number is the number reported, or when its dialled number is the person's own number. Only campaigns active around that time are checked. Reports older than 30 days cannot be matched.

| Result | What the person sees | What you see |
| - | - | - |
| A test call matched | "That call was part of a planned security exercise run by your organisation. Reporting it was exactly the right thing to do, and it has been recorded in your favour." | The person's verdict becomes **Reported**. The **Why** column says how many minutes after the call started. If they had given something away first, it says so. See [Read your results](https://docs.deepblocker.ai/vishing/results/overview.md). |
| Nothing matched | "Your report has been passed to your security team, who will look into it. If the caller asked you to do something, such as share a code, move money or install software, please do not do it until security has confirmed it is safe." | An email to your security contact with the subject **Possible real vishing attack reported by a member of staff**. It lists the number, the time, the person's number and note if given, how many test calls were checked, and a report reference. |

Nothing about who was called ever goes back to the browser. The page only learns "matched" or "not matched".

> [!TIP]
>
> The best-prepared teams add the link to the warm-up notice or the awareness email, so the way to report is in the person's hand before the call comes.

## Problems

> [accordion] The page says This report link is not valid
>
> The link was rotated, or it was copied with a character missing. Copy it again from **Fair testing** and share the new one.

> [accordion] The page says Too many reports from this network in a short time
>
> The page limits how many reports one network can send in a few minutes. Wait a few minutes and try again.

> [accordion] A real test was reported but the result still says Failed
>
> The time given was more than 30 minutes from the call, or the number did not match. Ask the person to report again with their own number filled in, which lets the match use the dialled number.

> [accordion] No alert email arrived for an unmatched report
>
> Check **Security contact email** on **Fair testing**. When it is empty, the alert goes to the workspace owner's address.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.