How to report a phishing email

Reporting a phishing email takes seconds, and it does more than tidy your inbox. It helps your provider's filters, alerts your IT team, and helps get fake websites taken down before someone else types a password into them. This guide gives the exact steps for Outlook and Microsoft 365, Gmail and Google Workspace, and Apple Mail, then shows which official channels to use in the US and UK.

Not sure the message is phishing? Run through our phishing email checklist first. Already clicked a link or typed a password? Go straight to what to do after clicking a phishing link, then come back to report it.

Where should you report a phishing email?

Most people need two reports: one inside the mail app, and one to an outside body. Use this table to pick the right ones.

How do you report phishing in Outlook and Microsoft 365?

Microsoft's built-in Report button works in Outlook for Microsoft 365, the new Outlook for Windows, Outlook on the web, Outlook for Mac, and Outlook for iOS and Android, as long as you're on a supported version (Microsoft Learn).

1. Select the message. You can select several at once.
2. Select Report in the ribbon or toolbar.
3. Choose Report phishing. For ordinary unwanted mail, choose Report junk instead.

What happens next depends on the option you chose:

• Report phishing deletes the message.
• Report junk moves it to the Junk Email folder and adds the sender to your Blocked Senders list.
• Not junk, used from the Junk Email folder, moves a good message back to the Inbox.

In a business, the admin decides where reports go: to a reporting mailbox your IT team watches, to Microsoft, or both. Admins review them on the User reported tab of the Submissions page in the Microsoft Defender portal. The Report button only appears when user reporting is turned on and the built-in button is selected, so if it's missing, ask IT how they want reports sent.

Microsoft's consumer guidance gives the same path for Outlook.com: Report > Report phishing. If you read your mail in a different email client, Microsoft asks you to attach the phishing message to a new email to phish@office365.microsoft.com. It says not to forward it, because "we need the original email as an attachment so we can examine the message headers."

For admins who want to go further, our guide to stopping phishing in Microsoft 365 covers the policies behind the filtering.

How do you report phishing in Gmail and Google Workspace?

Gmail Help gives these steps on a computer:

1. Open the message.
2. Next to Reply, click More (the three dots).
3. Click Report phishing.

Use spam reporting for unwanted marketing or junk that isn't trying to trick you. Google notes that when you move an email to Spam, it receives a copy of the message and any attachments and may analyze them. If you reported a message by mistake, the same More menu offers Report not phishing.

In Google Workspace, every user has the same option. Tell your admin as well, so they can check whether others received the message. Admins tuning Gmail's own protections can follow our guide to Gmail spam settings in Google Workspace.

How do you report phishing in Apple Mail and iCloud?

Apple Mail doesn't have a separate "report phishing" button. Use junk reporting, then forward Apple impersonations to Apple.

1. Mark it as junk. In Mail on Mac, select the message and click the Junk button in the toolbar. Mail moves it to the Junk mailbox. If Mail gets it wrong, use Move to Inbox or the Not Junk button (Apple Support).
2. If it pretends to be Apple, forward it to reportphishing@apple.com. Apple lists this address for suspicious emails that appear to come from Apple (Apple Support).
3. If it's ordinary spam in an iCloud, me.com or mac.com inbox, Apple says to mark it as junk rather than send it to an address.

Apple Mail is only the app. If your work account runs on Microsoft 365 or Google Workspace, also report the message through Outlook or Gmail on the web, or tell IT, so the report reaches the service that actually filters your mail.

Which agencies take phishing reports in the US?

The FTC and the Anti-Phishing Working Group

The FTC tells consumers to forward phishing emails to the Anti-Phishing Working Group at reportphishing@apwg.org, forward phishing texts to SPAM (7726), and report the attempt at ReportFraud.ftc.gov. If someone may have your Social Security, credit card or bank account number, the FTC points you to IdentityTheft.gov.

CISA

The joint phishing guidance from CISA, the NSA, the FBI and MS-ISAC (October 2023) encourages organizations to use the reporting features built into Outlook and other cloud email platforms. It also urges organizations to report phishing incidents to CISA at report@cisa.gov or on the 24/7 response line, (888) 282-0870 (CISA guidance, 2023). Use this route for an incident affecting your organization, not for every spam message.

The FBI's IC3

The same guidance says that to report spoofing or phishing attempts, or that you've been a victim, you can file a complaint with the FBI's Internet Crime Complaint Center at ic3.gov or contact your local FBI field office. If money left your account, call your bank first and ask it to recall the payment. Speed matters more than paperwork; our guide to business email compromise explains why.

How do you report phishing in the UK?

Forward the email to the NCSC's Suspicious Email Reporting Service at report@phishing.gov.uk. You can send as many suspicious emails as you like. The NCSC analyzes the email and any linked websites, and if it finds malicious activity it may work with hosting companies to remove the links. It can't tell you the outcome of each report, but says it acts on every message received. The NCSC reports 454.8k scam URLs removed as of July 2026.

The NCSC address isn't for reporting a crime. If you lost money or data, report it to Report Fraud at reportfraud.police.uk or on 0300 123 2040 in England, Wales or Northern Ireland, or to Police Scotland on 101.

What should you include, and what should you avoid?

1. Send the original. Use the report button, or attach the message. Don't paste the text or send a screenshot; investigators need the headers. Our guide on how to read email headers explains what they contain.
2. Don't click anything while reporting. The NCSC's advice is simple: "Don't click on any links in a suspicious email."
3. Say what you did. If you clicked, typed a password or opened a file, tell IT straight away. That changes the response.
4. Keep it proportionate. One report to your provider and one to the right agency is usually enough.
5. Delete it afterward. Once it's reported, there's no reason to keep it, unless IT asks you to.

If you're the admin and want to see where a reported message really came from, paste its headers into the free Email Header Analyzer. It runs in your browser and shows the SPF, DKIM and DMARC results.

How do businesses make reporting easy?

• Give staff one obvious way to report, usually the built-in button, and explain it during onboarding.
• Thank people who report, even for false alarms. Blame slows the next report down.
• Act on reports. Search for and remove other copies of the same message, and block the sender or URL where it makes sense.
• Filter before the inbox. Every phishing email stopped before delivery is one nobody has to report. See how spam filters work.

Next steps

1. Find the Report button in the mail app you use most, now, before you need it.
2. Save reportphishing@apwg.org (US) or report@phishing.gov.uk (UK) in your contacts.
3. Read how to spot a phishing email and share the checklist with your team.
4. If you manage a domain, check its SPF, DKIM and DMARC with the free Email Health Check. If you'd like filtering and per-user quarantine in front of every mailbox, see how iBlockSpam works.

Browse our other phishing and threat guides.