1. A method, comprising: generating a simulated phishing message, the message comprising a predetermined identifier value in a body of the message or in message metadata; electronically storing the predetermined identifier in a computerized data store; receiving a notification that a message delivered in an account associated with an individual has been identified by the individual as a possible phishing attack, the message having been received on a computing device of the individual, wherein the notification comprises an identifier value from a body of the message or from message metadata; determining whether the identified message is a known simulated phishing attack by comparing the predetermined identifier value to the identifier value from the body of the message or to the message metadata; if the message is determined to be a known simulated phishing attack, providing feedback to the individual confirming that the message was a simulated phishing attack; and if the message is determined not to be a known simulated phishing attack, forwarding the message for analysis to determine if the message is a real phishing attack or not.