This is how I approach it at work (a non-profit where we deal with sensitive data). Every new employee and volunteer goes through a 30-minute training webinar on security when they start: spotting phishing emails, choosing good passwords, 2FA etc.

At the end, I tell them that if something just feels off, even if they can't figure out why, I'd rather they call or message me on Slack than ignore it. It absolutely never bothers me when they do it - in fact, it makes me feel better. Maybe 1% of reports are actual issues, but I'd rather deal with 99% false positives than miss even one thing.