How to report a phishing email
Reporting a phishing email takes a few seconds and helps protect everyone using the same email service. Here is how in each app, and what to do if you already clicked.
In Gmail, open the email, select the three dots, then Report phishing. In Outlook, select Report → Report phishing. In Yahoo Mail, select the three dots, then Report phishing. You can also forward phishing emails to the Anti-Phishing Working Group at reportphishing@apwg.org. If you clicked a link or entered a password, change that password right away.
Report it in your email app
- Gmail: open the message, select More (three dots) next to Reply, then Report phishing.
- Outlook.com and new Outlook: select the message, then Report → Report phishing on the toolbar.
- Classic Outlook (work): use the Report button if your organization has added it, or follow your IT team's instructions.
- Yahoo Mail: open the message, select More (three dots), then Report phishing.
- Apple Mail: move it to Junk, and forward iCloud phishing to
reportphishing@apple.com.
Other places to report
- Anti-Phishing Working Group: forward the email to
reportphishing@apwg.org. - US Federal Trade Commission: report scams at
ReportFraud.ftc.gov. - The company being impersonated: many banks and brands have a phishing address on their website.
- Your workplace: tell IT straight away, even if you only opened it.
If you clicked a link or replied
- Change the password for the account the email pretended to be from, and anywhere you reuse it.
- Turn on 2-Step Verification or a passkey.
- If you shared card or bank details, call your bank using the number on your card.
- If you opened an attachment, run a security scan, and tell IT on a work device.
- Watch your accounts for unknown sign-ins and new forwarding rules.
Common phishing email examples
- "Your account will be suspended. Verify now."
- A delivery company asking you to pay a small fee to release a parcel.
- A fake invoice or payment notice with an attachment.
- "Unusual sign-in attempt" with a link to a fake login page.
- A message from your "CEO" asking you to buy gift cards urgently.
- A shared-document notification from an address you don't know.
Learn the warning signs in is this email legit?, and check where a message really came from with the email header analyzer.
What type of attack is phishing?
Phishing is a social engineering attack: it tricks people, rather than breaking into systems directly. Variants include spear phishing (aimed at one person or company), whaling (aimed at executives), smishing (by text message) and vishing (by phone).
Questions people ask
- Does reporting phishing in Gmail do anything?
- Yes. It helps Google's filters spot similar emails and protect other users. It also moves the message out of your inbox.
- Should I reply to a phishing email?
- No. Replying confirms your address is active. Report it and delete it.
- Is it safe to open a phishing email?
- Opening it in a modern email app is usually low risk. The danger is clicking links, opening attachments or replying with information.
- Where do I forward phishing emails?
- To reportphishing@apwg.org, and to the company being impersonated if it has a phishing address.