5.2Reporting & raising the alarm (internal & official)
The essentials in 30 seconds
- Internal first: IT/CISO/DPO (button, address, contact person) — always the first reflex at work.
- Official next: cybermalveillance.gouv.fr, 33700 (SMS), signal-spam.fr (emails) — doubt is enough.
- Complaint if offence: fraud, hacking, extortion — without a complaint, no case file (investigation, insurance).
Running mini-case — Karim hesitates, then reports
The day after the incident, Karim receives a fraudulent “parcel blocked” SMS on his phone and, at the office, a phishing email imitating his bank. Ashamed of having clicked the day before, he hesitates to “overload IT”. Then he pulls out his directory: internal reporting button, forwarding the SMS to 33700, sending the email to signal-spam.fr. Sequel to case 5.1 — Karim moves from victim to reporter.
Sequel to case 5.1 — Karim builds his directory with his quick-reaction card.
1. Reporting triggers response
Reporting is not a formality: it is what lets the company respond and the authorities trace the attackers. Reporting early costs little and pays off big: attacks detected quickly cause far less damage. Karim reports the same day, not “when he is sure”.
Reporting does not require certainty: doubt is enough — triage is the experts' job. Better a hundred benign reports than one silent incident.
2. The order of channels
Internal first: IT/CISO/DPO (reporting button, address, contact person) for anything work-related. Official next: cybermalveillance.gouv.fr (assistance and diagnosis), 33700 (fraudulent SMS), signal-spam.fr (phishing emails). Karim displays this order on his directory, next to his 5.1 card.
At the office in Algiers, Karim looks for no invented external emergency number: the internal channel (CISO/management) comes first, official platforms complete it, colleagues are warned without circulating the trap.
3. Complaint and reporting culture
Fraud, hacking, extortion: filing a complaint triggers the investigation and supports insurance and legal remedies. Without a complaint, no case file — even if the individual outcome remains uncertain. Frauds are serial: each complaint feeds investigations.
Security teams prefer good reporters to silent ones: many organisations congratulate them. Reporting what you see (suspicious email, abnormal behaviour) is a team move, not paranoia.
🔎 Concrete example — Karim's directory
The emergency kit displayed next to the 5.1 card.
INTERNAL: Outlook reporting button? security address? contact + number: _______________
EXTERNAL: SMS -> 33700 | phishing -> signal-spam.fr | victim -> cybermalveillance.gouv.fr
MOVE: test on the next spam received (internal button + external platform).
-> Doubt never stays without a recipient.Reading: three lines, zero hesitation on D-day.
Lesson: displayed with the quick-reaction card, the two form the kit.
Section vocabulary
- Internal reporting
- The organisation's official channel: always the first reflex for anything work-related.
Simple example: Karim clicks the reporting button then calls the IT contact.
What it is not: telling the story at the coffee machine without warning IT.
Reflex: do I know the internal channel (button, address, name) by heart?
- Cybermalveillance.gouv.fr
- Assistance and diagnosis for victims + connection with approved providers.
Simple example: Karim runs the diagnosis there after the incident to prepare next steps.
What it is not: seeing it as an online police station that replaces the complaint.
Reflex: confirmed victim = assisted diagnosis, then complaint if offence.
- 33700 / signal-spam
- Fraudulent SMS to 33700, phishing emails to signal-spam.fr: the addresses for everyday doubt.
Simple example: Karim forwards the “parcel” SMS to 33700 and the bank email to signal-spam.fr.
What it is not: deleting spam without reporting it anywhere.
Reflex: next spam = next tested report.
- Complaint
- The filing that triggers the investigation and conditions insurance and remedies.
Simple example: After the fraud, Karim files a complaint with screenshots and times.
What it is not: “the fraudster is far away, it is useless”.
Reflex: offence = complaint, with the evidence file (5.1).
- Everyday reporter
- Reporting what you see, without certainty: the team move that reduces damage.
Simple example: Karim reports a suspicious email without being sure: it was indeed phishing.
What it is not: waiting for certainty before daring to bother anyone.
Reflex: doubt is enough — triage belongs to the experts.
In practice — Build your reporting directory
- Internal: note THE official channel of your organisation (Outlook reporting button? security address? contact person's name?).
- External: save the 3 reflexes — fraudulent SMS → forward to 33700; phishing → signal-spam.fr; confirmed victim → cybermalveillance.gouv.fr.
- Test the move: actually report the next spam/phishing received (internal button + external platform).
- Display this directory with your 5.1 quick-reaction card: the two form your emergency kit.
Ready-to-say script — report a doubt orally
“I am reporting a doubt, without certainty: I received a suspicious [SMS / email] [subject, sender, time]. I forwarded it via [internal button / 33700 / signal-spam.fr] and I neither clicked nor replied. Tell me if you want the screenshots.”
Say to the contact person or in a team meeting: factual, without shame, stating the channel used.
Copy-paste template — reporting directory
REPORTING DIRECTORY (display with the 5.1 card)
INTERNAL: button ___ | address ___ | contact + number: _______________
EXTERNAL: suspicious SMS -> 33700 | phishing email -> signal-spam.fr | victim -> cybermalveillance.gouv.fr
OFFENCE (fraud, hacking, extortion) -> file a complaint + evidence file (screenshots, times).
RULE: doubt is enough — I report early, experts triage.Solo / small office
Karim alone: internal channel = the boss + the IT provider noted on the directory; official platforms as direct backup.
Very small business / tight budget
Directory printed and stuck next to each workstation: zero tools, just the 3 external addresses copied without error.
SME in Algiers
Karim prioritises the internal channel (CISO/management in Algiers) then the official platforms; no invented external number.
New team
Ritual: everyone reports a real spam this week (internal + external) and tells in 2 minutes what happened.
✓ Best practices
- Report internally first, official platforms next.
- Report early: doubt is enough, triage is the experts' job.
- File a complaint in case of fraud/hacking (investigation + insurance).
✗ Common pitfalls
- Keeping a doubt to yourself for fear of “overloading IT”.
- Waiting for certainty before reporting.
- Skipping the complaint (no file, no compensation).
Key takeaways
- Order of reflexes: internal first (IT/contact), official platforms next, complaint if offence.
- Reporting early costs little and pays off big: attacks detected quickly cause far less damage.
- 33700 (SMS), Signal Spam (emails), Cybermalveillance (assistance): three addresses to know by heart.
- Reporting does not require certainty: doubt is enough — triage is the experts' job.
48h challenge — apply tomorrow
Fill in your directory (1 internal channel + 3 external addresses) and actually report the next spam received: internal button + external platform.
- I can quote the order: internal, official, complaint.
- My directory is filled in and displayed with the 5.1 card.
- I reported 1 real spam (internal + external).
Frequently asked questions
I report a lot: will I overload IT?
No: security teams prefer a hundred benign reports to one silent incident. Many organisations congratulate the best “reporters” — it is an indicator of security culture, not paranoia.
What is my complaint for if the fraudster is abroad?
It feeds investigations (frauds are serial), conditions insurance compensation and bank remedies. Without a complaint, no case file — even if the individual outcome remains uncertain.
Karim doubts an SMS at work, without certainty. What to do?