My company does phishing email exercises, and they've added a "report phishing" button to Outlook you're supposed to hit, either for the fake messages or any real phish attempts you get, or worse, fall for.

The difficulty is that the company has outsourced many functions, meaning that there are external companies I often haven't heard of sending messages we have to interact with. Worse, one of those vendors has a very spammy-looking style and has even mis-spelled our company's name before in their mails.