Reporting a phishing email takes less than a minute and does real good. A report teaches your mail provider's filters to catch the same message for other people, helps the impersonated brand take down fake sites and, at work, alerts your security team before a colleague falls for it. Yet many people simply delete the message because they do not know where to send it. The right place depends on your mail app, on the brand being imitated and on whether you are at work or at home. This guide gives the steps for Gmail, Outlook, Yahoo and Apple Mail, lists the central reporting addresses and services that exist for forwarding phishing messages, explains how to report to the company being impersonated, covers what to include and what not to do, and explains how senders can handle reports about their own domain. For help recognising a phishing message in the first place, read how to spot a phishing email.
Why reporting matters
- It protects others. Mail providers use reports to block the sender, the link and the pattern for everyone.
- It helps takedowns. Brands and security organisations use reports to find and remove fake pages.
- It protects your organisation. A company security team can search all mailboxes for the same message and remove it.
- It improves your own filtering. Marking a message as phishing teaches your account what to hide in future.
How to report phishing in Gmail
- Open the suspicious message.
- Click the three-dot menu at the top right of the message, next to the reply arrow.
- Choose Report phishing.
- Confirm in the dialog that appears. Gmail sends the message to Google for review and moves it out of your inbox.
On the Gmail mobile app, the three-dot menu in the message view has the same option. If you only see "Report spam", use it, since it still helps, but prefer the phishing option when it is offered. Google also provides a way to report scams to the wider ecosystem; check its current help pages for the latest options.
How to report phishing in Outlook
- Select the message in your inbox, but do not open links in it.
- On the Home tab of the desktop app, choose Report, then Phishing. In Outlook on the web and in new Outlook, find Report in the toolbar and choose Report phishing.
- If your organisation uses a security add-in, use its button instead, since it routes the report to your security team.
Microsoft 365 administrators can enable the built-in Report button and send user reports to a central mailbox for review. If you cannot see the button, ask your IT team or forward the message as an attachment to the address they provide. Forwarding as an attachment keeps the headers intact, which investigators need.
How to report phishing in Yahoo Mail and Apple Mail
In Yahoo Mail, open the message and use the Spam option in the toolbar, or the more menu if it offers a report option for phishing. In Apple Mail and iCloud Mail, there is a Move to Junk option, and Apple asks that phishing messages that imitate Apple be forwarded to a dedicated address, which is [email protected]. Menu names change between versions, so look through the toolbar and message menu if your screen differs.
Central reporting addresses and services
Several organisations accept forwarded phishing messages. Check each organisation's current page before relying on an address, since services change.
| Where | What it is | How |
|---|---|---|
| Anti-Phishing Working Group | An industry coalition that collects phishing reports | Forward the message to [email protected] |
| US Federal Trade Commission | US consumer protection agency | Report at reportfraud.ftc.gov; forwarding is also accepted by the FTC for some scams |
| Apple | For messages that imitate Apple | Forward to [email protected] |
| PayPal | For messages that imitate PayPal | Forward to [email protected] |
| Amazon | For messages that imitate Amazon | Forward to [email protected] |
| Your national cyber security centre | Most countries run a service for reporting scams | Search your country's official government site |
In India, you can search for the official national cyber crime reporting portal on a government website. In the United Kingdom, the National Cyber Security Centre runs a suspicious email reporting service. Always reach these by typing the address from an official source and not by following a link from an email.
How to report to the company being impersonated
- Go to the company's real website by typing the address yourself.
- Search its help or security section for "report phishing" or "report a scam". Most large brands publish an address or form.
- Forward the message as an attachment if allowed, or copy the full headers and the body.
- If the message concerned a bank or payment account, also call the number on your card and ask whether the message was genuine.
What to include in a report
- The original message, forwarded as an attachment so the headers stay intact.
- The date and time received.
- Any links, shown as text, not clicked.
- A one-line description, such as "pretends to be a delivery company and asks for card details".
Explain to colleagues how to forward as an attachment: in Outlook, use Forward as Attachment from the More menu; in Gmail, choose the three-dot menu and Forward as attachment on the message; Apple Mail has a Forward as Attachment command in its Message menu. See email headers for why they matter.
What not to do
- Do not click links, scan QR codes or open attachments to "see what happens".
- Do not reply to the sender or use the unsubscribe link in a phishing message, since that confirms your address is live.
- Do not forward the message to friends as a warning, which spreads the lure. Describe it instead.
- Do not post the full message publicly with live links.
- Do not delete the message before reporting if your employer asks to see it.
If your own brand is being impersonated
If you send email, you may receive reports about phishing that uses your name. The most effective defence is authentication: publish SPF and DKIM, set a DMARC policy and move toward quarantine or reject so receivers refuse messages that fake your domain. DMARC reports show who is sending as you. See DMARC aggregate reports. Monitor lookalike domains, report fake sites to hosting providers and registrars and tell your customers how you will and will not contact them. Keep your own mail trustworthy: use your own domain, avoid link shorteners in transactional mail and make official messages easy to verify.
After you report
- Delete the message from the inbox and the trash.
- If you clicked or typed anything, follow the recovery steps in our phishing guide.
- Warn colleagues in words, not by forwarding the lure.
- Check that your own accounts have multi-factor authentication enabled.
Protect your domain from being forged Check your SPF, DKIM and DMARC records and move toward an enforcing policy.
References and further reading
Frequently asked questions
How do I report a phishing email in Gmail?
Open the message, click the three-dot menu, choose Report phishing and confirm. Google reviews the message and removes it from your inbox.
How do I report a phishing email in Outlook?
Select the message, choose Report then Phishing in the toolbar, or use your organisation's security add-in. Ask IT if the button is missing.
Where can I forward phishing emails?
The Anti-Phishing Working Group accepts forwards at [email protected], and many brands publish their own address, such as [email protected] and [email protected]. Check each organisation's current page.
Should I forward phishing as an attachment?
Yes when possible. Forwarding as an attachment keeps the headers intact, which investigators need.
Should I delete a phishing email after reporting it?
Yes, unless your employer asks you to keep it. Do not click links or reply to the sender.