From Verizon's 2024 DBIR: in phishing simulation data, 20% of users reported the phishing email, and 11% of the users who clicked it also reported it.
Read that second number again. People who got fooled still raised their hand.
That's the most valuable thing a user can do, and most programs treat it like a confession instead of a lead.
From the investigation side, a fast report is gold. It gives you a timestamp, a sample, and a starting point before the attacker has time to settle in.
If your program shames clickers, you teach people to stay quiet. Quiet is how a 21-second click turns into a months-long breach.
Make reporting easy. Make it safe. Then actually investigate what comes in.