What should you do first when you receive a threatening email from a coworker?

What should you do first when you receive a threatening email from a coworker?

• A. Preserve evidence and report to HR or security
• B. Delete the email
• C. Ignore it
• D. Reply with a warning

Answer: (A)

The main idea here is to protect yourself and initiate a proper response by preserving evidence and escalating through the right channels. When a threatening email arrives, the first action is to save the message in its original form, including all headers and any attachments, and to note when and how you received it. Do not delete, edit, or forward it beyond the required reporting channel. Keeping the exact message with its metadata creates a reliable record that investigators can use to assess risk and determine what steps to take next. Then report the incident to HR or the security team. These groups are equipped to handle threats, coordinate with IT to preserve system logs, and decide on appropriate actions—such as safety measures, monitoring, or involving law enforcement. Prompt reporting helps protect you and others and ensures the incident is managed under policy rather than as an informal response. Deleting, ignoring, or replying with a warning are not suitable. Deleting erases evidence that could be crucial for investigations. Ignoring leaves the threat unaddressed and may allow it to continue or escalate. Reaching back with a warning can escalate the situation and complicate investigations, and it might be seen as engaging with the sender in a way that could be harmful or misinterpreted. If you feel there’s immediate danger, contact local authorities or campus security right away.

The main idea here is to protect yourself and initiate a proper response by preserving evidence and escalating through the right channels. When a threatening email arrives, the first action is to save the message in its original form, including all headers and any attachments, and to note when and how you received it. Do not delete, edit, or forward it beyond the required reporting channel. Keeping the exact message with its metadata creates a reliable record that investigators can use to assess risk and determine what steps to take next.

Then report the incident to HR or the security team. These groups are equipped to handle threats, coordinate with IT to preserve system logs, and decide on appropriate actions—such as safety measures, monitoring, or involving law enforcement. Prompt reporting helps protect you and others and ensures the incident is managed under policy rather than as an informal response.

Deleting, ignoring, or replying with a warning are not suitable. Deleting erases evidence that could be crucial for investigations. Ignoring leaves the threat unaddressed and may allow it to continue or escalate. Reaching back with a warning can escalate the situation and complicate investigations, and it might be seen as engaging with the sender in a way that could be harmful or misinterpreted.

If you feel there’s immediate danger, contact local authorities or campus security right away.