What happens when Google Workspace users report phishing, and how do admins handle it?

Your users are the last line of defense, and in Gmail they report suspicious mail with one click. What happens next surprises many admins: the report goes to Google, not to you. This guide explains where Google Workspace user reports actually go, where admins can see them, which alerts to route, and how to build a reporting workflow that gets suspicious mail in front of your security team quickly.

If you run Microsoft 365 as well, its equivalent is covered in our guide to the Microsoft 365 Report button and user reported settings. For the user-facing steps across every mail app, see how to report a phishing email. Details were checked against Google's documentation at the time of writing (November 2026).

How do Google Workspace users report phishing in Gmail?

Users report phishing from the message's More menu. Google's steps on a computer are (Gmail Help):

1. Open the message in Gmail.
2. Next to Reply, click More (three dots).
3. Click Report phishing.

If Gmail wrongly flagged a message, the same menu offers Report not phishing. Report spam is a separate action for unwanted junk. Google adds that "when you manually move an email into your Spam folder, Google receives a copy of the email and any attachments" and may analyze them.

Teach the difference in one sentence: spam wastes your time, phishing tries to trick you. When users can't tell, ask them to choose Report phishing. A false phishing report costs you a minute; a missed one can cost an account.

Where do Gmail phishing reports go?

Gmail phishing reports go to Google, where they train Gmail's classification. Google's admin documentation says users can mark messages "as spam, not spam, or phishing," and "with Gmail, this trains the system to identify similar messages as spam, not spam, or phishing in the future" (User report).

Admins get signals about reports, not the reported messages. At the time of writing (November 2026), Google's Admin Help doesn't document a setting that copies Report phishing reports to a mailbox you choose. Instead, Google documents the alert center alerts, the Security dashboard and investigation tool log events covered below. That's the key difference from Microsoft 365, where User reported settings can send reports to Microsoft, to your own reporting mailbox, or to both:

So in Google Workspace, your workflow has to be built around alerts, plus a reporting address if you want the actual message.

Which admin alerts cover user-reported phishing?

Three system-defined alerts react to what users report. All three are Active by default in Google's system-defined rules list:

Google's alert details page says the User-reported phishing alert shows a summary, the date, the sender, Total user reports and Received by (the recipients' usernames), plus a sample table with message ID, subject hash, body hash, recipient and attachment hashes. From there you can "take action to block the sender."

Active doesn't always mean someone reads it. Each rule has its own email recipients. Check them under Menu > Rules, filter on System defined, open the rule and look at its actions. Our alert center guide has the full procedure, including the limit that system-defined rules only email internal users.

How do you see user reports in the Security dashboard?

The Security dashboard shows how users label mail over time. Go to Menu > Security > Security center > Dashboard, then click View Report in the User reports panel. You need the Security center administrator privilege.

Google lists the panel for Frontline Plus, Enterprise Plus, Education Standard and Education Plus, and Enterprise Essentials Plus at the time of writing (November 2026). The graph splits reports into Not spam, Spam and Phishing, and you can filter by traffic source (external or internal), domain and date range. One limit: "data is displayed only for the last 31 days," even if you choose a longer range. You can export the graph data to a Google Sheet.

Use it for trends. A rising Phishing line from internal traffic can mean an account inside your domain is compromised and sending phish; follow our Google Workspace compromised account recovery guide if you see that. A high Not spam count means your filters or your allowlists need attention.

How do you get the reported message itself?

Ask users to send a copy to a dedicated reporting address as well as clicking Report phishing. Because Gmail's report doesn't reach you as a message, a reporting address is the simplest way to get the full original, with headers, for analysis.

Set it up like this:

1. Create a Google Group or shared mailbox such as phishing@yourcompany.example, restricted to your security staff.
2. Tell users to report in two steps: Report phishing first, then forward the message as an attachment to the reporting address. Google's Gmail Help describes Forward as attachment: select the message's checkbox in the inbox, click More > Forward as attachment. The message arrives as an .eml file with its headers intact.
3. Write a one-line template so reports are consistent, for example:

Subject: Suspected phishing - "Your mailbox is full" from it-support@mail-helpdesk.example
I clicked: No. I entered a password: No. Received: today 09:12.

That's an example; adapt the questions to your own process. 4. Don't let anyone set up automatic forwarding of all mail to the reporting address; that floods it.

Some organizations prefer a Google Workspace Marketplace add-on that combines both steps into one button. If you choose one, check which OAuth scopes it asks for before allowing it domain-wide.

Analyze reported messages with the Email Header Analyzer, which runs in your browser so nothing is uploaded. For what to look for, see how to read email headers.

How should admins triage a user phishing report?

Triage means deciding quickly whether the report is real, how many people received it, and whether anyone interacted with it. Work through this checklist when a User-reported phishing alert or a reporting-address message arrives:

1. Confirm it's phishing. Check the sender address, Reply-To, links and authentication results. Many reports are legitimate mail; reply to the user either way.
2. Find every recipient. With Frontline Plus, Enterprise Plus or Education Plus, open Security > Security center > Investigation tool, choose Gmail log events, and search by subject, sender and date (Google's procedure). On other editions, use Email Log Search.
3. Remove the copies. In the investigation tool, select the results and choose Actions > Delete messages, or mark them as phishing. Our investigation tool guide covers the options.
4. Check who clicked. Search Gmail log events for link clicks and attachment downloads on that message.
5. Contain accounts. Anyone who entered a password needs a reset and a session sign-out. See what to do after clicking a phishing link.
6. Block the source. Add the sender or domain to a Blocked senders list, and check for lookalike domains of your own brand with the Lookalike Domain Generator.
7. Close the loop. Tell the reporter what you found and thank them.

Google also notes, for its Phishing message detected post-delivery alert, that unopened messages are removed automatically, but a message someone "has opened or otherwise interacted with" stays "until manually removed." Don't assume Gmail cleaned up after a report.

How do you test your phishing reporting workflow?

Test the workflow end to end before you need it, and again whenever staff or settings change. A test proves that reports reach a person, not just a dashboard.

1. From an outside account you control, send a harmless, clearly labeled test message to two or three volunteers. Put "TEST" in the subject so nobody mistakes it for a real attack.
2. Ask the volunteers to click Report phishing and forward the message as an attachment to your reporting address.
3. Confirm the forwarded .eml files arrived with full headers, and note how long the reporting address took to get a human response.
4. Check the alert center over the next hours. Alerts depend on Google's thresholds, so a few test reports may not trigger one; that's useful to know, because it means the reporting address is your faster signal.
5. Write down what broke and fix it: a group that rejects outside forwards, an alert emailing a departed admin, or a mailbox nobody watches.

Repeat the test after any change to groups, admin roles or alert recipients.

Can you export user reports with an API?

Yes. Two Google APIs expose user report data, which is useful if you feed a ticketing system or a SIEM (security information and event management tool):

• Alert Center API. Google's alert types reference lists User reported phishing, Suspicious message reported and User reported spam spike under the Gmail phishing source, with the API type MailPhishing.
• Reports API. Call Activities.list() with applicationName=gmail. Google's Gmail activity events reference says event_info.mail_event_type value 3 means "a Gmail user manually applied a spam classification to the message. For example, the user marked the message as spam, phishing, or not spam." Google notes that Gmail queries need a start and end time no more than 30 days apart.

How do you get more users to report phishing?

Users report more when reporting is easy, safe and acknowledged. Three habits make the difference:

• Make it blame-free. People who clicked are the ones you most need to hear from. Say so in onboarding and in every reminder.
• Answer every report. A short reply, even "this one was legitimate, thanks", keeps people reporting.
• Show real examples. Share a redacted recent phish each month. Our email security awareness training guide has a lightweight program, and how to spot a phishing email is a good handout.

If your MX points to a filtering gateway, Gmail's reports still train Gmail, but they don't teach the gateway. Feed confirmed phishing into the gateway's block lists too, so the next copy is stopped before it reaches Gmail.

Next steps

• Open Menu > Rules and confirm the User-reported phishing, Suspicious message reported and Spike in user-reported spam alerts email your security team.
• Create a phishing@ reporting address and publish the two-step "Report phishing, then forward as attachment" instruction.
• Write down your triage checklist and who owns each step.
• To stop more phishing before users ever see it, iBlockSpam filters mail at the MX level in front of Google Workspace, with a personal quarantine and digests for every user.