# How to report a phishing email

URL: https://iblockspam.com/blog/report-phishing-email
Last updated: 2026-10-09
Published: 2026-10-09
Topic: Phishing & threats
Author: iBlockSpam Team

> How to report phishing in Outlook and Microsoft 365, Gmail and Apple Mail, plus where to send it next: APWG, the FTC, CISA, the FBI's IC3 and the UK's NCSC.

## Short answer

Use your mail app's report button first: Report > Report phishing in Outlook, More > Report phishing in Gmail, or the Junk button in Apple Mail. In the US, also forward it to reportphishing@apwg.org and report fraud at ReportFraud.ftc.gov. In the UK, forward it to report@phishing.gov.uk. Lost money? Call your bank, then IC3.

Reporting a phishing email takes seconds, and it does more than tidy your inbox. It helps your provider's filters, alerts your IT team, and helps get fake websites taken down before someone else types a password into them. This guide gives the exact steps for Outlook and Microsoft 365, Gmail and Google Workspace, and Apple Mail, then shows which official channels to use in the US and UK.

Not sure the message is phishing? Run through our [phishing email checklist](https://iblockspam.com/blog/how-to-spot-a-phishing-email) first. Already clicked a link or typed a password? Go straight to [what to do after clicking a phishing link](https://iblockspam.com/blog/what-to-do-after-clicking-phishing-link), then come back to report it.

## Where should you report a phishing email?

Most people need two reports: one inside the mail app, and one to an outside body. Use this table to pick the right ones.

| Situation | Report to | How |
|---|---|---|
| Any phishing email | Your mail provider | The report button in Outlook, Gmail or Apple Mail |
| At work | Your IT team | The report button, plus whatever internal channel IT asks for |
| You're in the US | Anti-Phishing Working Group | Forward to reportphishing@apwg.org |
| US, a scam or fraud attempt | Federal Trade Commission | ReportFraud.ftc.gov |
| US organization, a phishing incident | CISA | report@cisa.gov or (888) 282-0870 |
| US, you lost money or were a victim | FBI Internet Crime Complaint Center | ic3.gov, after calling your bank |
| You're in the UK | NCSC Suspicious Email Reporting Service | Forward to report@phishing.gov.uk |
| UK, you lost money | Report Fraud or Police Scotland | reportfraud.police.uk or 0300 123 2040; in Scotland, call 101 |
| It impersonates Apple | Apple | Forward to reportphishing@apple.com |
| It impersonates another company | That company | Use the contact details on its real website |

## How do you report phishing in Outlook and Microsoft 365?

Microsoft's built-in **Report** button works in Outlook for Microsoft 365, the new Outlook for Windows, Outlook on the web, Outlook for Mac, and Outlook for iOS and Android, as long as you're on a supported version ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/submissions-outlook-report-messages)).

1. Select the message. You can select several at once.
2. Select **Report** in the ribbon or toolbar.
3. Choose **Report phishing**. For ordinary unwanted mail, choose **Report junk** instead.

What happens next depends on the option you chose:

- **Report phishing** deletes the message.
- **Report junk** moves it to the Junk Email folder and adds the sender to your Blocked Senders list.
- **Not junk**, used from the Junk Email folder, moves a good message back to the Inbox.

In a business, the admin decides where reports go: to a reporting mailbox your IT team watches, to Microsoft, or both. Admins review them on the **User reported** tab of the **Submissions** page in the Microsoft Defender portal. The Report button only appears when user reporting is turned on and the built-in button is selected, so if it's missing, ask IT how they want reports sent.

Microsoft's [consumer guidance](https://support.microsoft.com/en-us/security/protect-yourself-from-phishing) gives the same path for Outlook.com: **Report** > **Report phishing**. If you read your mail in a different email client, Microsoft asks you to attach the phishing message to a new email to phish@office365.microsoft.com. It says not to forward it, because "we need the original email as an attachment so we can examine the message headers."

For admins who want to go further, our guide to [stopping phishing in Microsoft 365](https://iblockspam.com/blog/stop-phishing-emails-microsoft-365) covers the policies behind the filtering.

## How do you report phishing in Gmail and Google Workspace?

[Gmail Help](https://support.google.com/mail/answer/8253?hl=en) gives these steps on a computer:

1. Open the message.
2. Next to **Reply**, click **More** (the three dots).
3. Click **Report phishing**.

Use spam reporting for unwanted marketing or junk that isn't trying to trick you. Google notes that when you move an email to Spam, it receives a copy of the message and any attachments and may analyze them. If you reported a message by mistake, the same **More** menu offers **Report not phishing**.

In Google Workspace, every user has the same option. Tell your admin as well, so they can check whether others received the message. Admins tuning Gmail's own protections can follow our guide to [Gmail spam settings in Google Workspace](https://iblockspam.com/blog/gmail-spam-settings-google-workspace).

## How do you report phishing in Apple Mail and iCloud?

Apple Mail doesn't have a separate "report phishing" button. Use junk reporting, then forward Apple impersonations to Apple.

1. **Mark it as junk.** In Mail on Mac, select the message and click the **Junk** button in the toolbar. Mail moves it to the Junk mailbox. If Mail gets it wrong, use **Move to Inbox** or the **Not Junk** button ([Apple Support](https://support.apple.com/guide/mail/mlhlp1065/mac)).
2. **If it pretends to be Apple**, forward it to reportphishing@apple.com. Apple lists this address for suspicious emails that appear to come from Apple ([Apple Support](https://support.apple.com/en-us/102568)).
3. **If it's ordinary spam in an iCloud, me.com or mac.com inbox**, Apple says to mark it as junk rather than send it to an address.

Apple Mail is only the app. If your work account runs on Microsoft 365 or Google Workspace, also report the message through Outlook or Gmail on the web, or tell IT, so the report reaches the service that actually filters your mail.

## Which agencies take phishing reports in the US?

### The FTC and the Anti-Phishing Working Group

The [FTC](https://consumer.ftc.gov/articles/how-recognize-and-avoid-phishing-scams) tells consumers to forward phishing emails to the Anti-Phishing Working Group at **reportphishing@apwg.org**, forward phishing texts to **SPAM (7726)**, and report the attempt at **ReportFraud.ftc.gov**. If someone may have your Social Security, credit card or bank account number, the FTC points you to IdentityTheft.gov.

### CISA

The joint phishing guidance from CISA, the NSA, the FBI and MS-ISAC (October 2023) encourages organizations to use the reporting features built into Outlook and other cloud email platforms. It also urges organizations to report phishing incidents to CISA at **report@cisa.gov** or on the 24/7 response line, **(888) 282-0870** ([CISA guidance, 2023](https://www.cisa.gov/sites/default/files/2025-03/Phishing%20Guidance%20-%20Stopping%20the%20Attack%20Cycle%20at%20Phase%20One%20508.pdf)). Use this route for an incident affecting your organization, not for every spam message.

### The FBI's IC3

The same guidance says that to report spoofing or phishing attempts, or that you've been a victim, you can file a complaint with the FBI's Internet Crime Complaint Center at [ic3.gov](https://www.ic3.gov/) or contact your local FBI field office. If money left your account, call your bank first and ask it to recall the payment. Speed matters more than paperwork; our guide to [business email compromise](https://iblockspam.com/blog/business-email-compromise-prevention) explains why.

## How do you report phishing in the UK?

Forward the email to the NCSC's Suspicious Email Reporting Service at **report@phishing.gov.uk**. You can send as many suspicious emails as you like. The [NCSC](https://www.ncsc.gov.uk/collection/phishing-scams/report-scam-email) analyzes the email and any linked websites, and if it finds malicious activity it may work with hosting companies to remove the links. It can't tell you the outcome of each report, but says it acts on every message received. The NCSC reports 454.8k scam URLs removed as of July 2026.

The NCSC address isn't for reporting a crime. If you lost money or data, report it to **Report Fraud** at reportfraud.police.uk or on 0300 123 2040 in England, Wales or Northern Ireland, or to Police Scotland on **101**.

## What should you include, and what should you avoid?

1. **Send the original.** Use the report button, or attach the message. Don't paste the text or send a screenshot; investigators need the headers. Our guide on [how to read email headers](https://iblockspam.com/blog/how-to-read-email-headers) explains what they contain.
2. **Don't click anything while reporting.** The NCSC's advice is simple: "Don't click on any links in a suspicious email."
3. **Say what you did.** If you clicked, typed a password or opened a file, tell IT straight away. That changes the response.
4. **Keep it proportionate.** One report to your provider and one to the right agency is usually enough.
5. **Delete it afterward.** Once it's reported, there's no reason to keep it, unless IT asks you to.

If you're the admin and want to see where a reported message really came from, paste its headers into the free [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer). It runs in your browser and shows the SPF, DKIM and DMARC results.

## How do businesses make reporting easy?

- **Give staff one obvious way to report**, usually the built-in button, and explain it during onboarding.
- **Thank people who report**, even for false alarms. Blame slows the next report down.
- **Act on reports.** Search for and remove other copies of the same message, and block the sender or URL where it makes sense.
- **Filter before the inbox.** Every phishing email stopped before delivery is one nobody has to report. See [how spam filters work](https://iblockspam.com/blog/how-spam-filters-work).

## Next steps

1. Find the Report button in the mail app you use most, now, before you need it.
2. Save reportphishing@apwg.org (US) or report@phishing.gov.uk (UK) in your contacts.
3. Read [how to spot a phishing email](https://iblockspam.com/blog/how-to-spot-a-phishing-email) and share the checklist with your team.
4. If you manage a domain, check its SPF, DKIM and DMARC with the free [Email Health Check](https://iblockspam.com/tools/email-health-check). If you'd like filtering and per-user quarantine in front of every mailbox, see [how iBlockSpam works](https://iblockspam.com/how-it-works).

Browse our other [phishing and threat guides](https://iblockspam.com/blog/topic/threats).

## Frequently asked questions

### What happens when I click Report phishing in Outlook?

In Microsoft 365, the message is deleted from your mailbox and, depending on your organization's settings, sent to your IT team's reporting mailbox, to Microsoft, or both. Reporting a message as junk instead moves it to Junk Email and adds the sender to your Blocked Senders list.

### Should I forward a phishing email or send it as an attachment?

Use your mail app's report button where you can, because it sends the original message. If you must email a report, attach the phishing message rather than forwarding it. Microsoft asks for the original as an attachment so it can examine the message headers, which forwarding can strip or change.

### Where do I report a phishing email in the UK?

Forward it to the NCSC's Suspicious Email Reporting Service at report@phishing.gov.uk. The NCSC analyzes the email and linked sites and can work with hosting companies to remove malicious links. If you lost money or data, report it to Report Fraud in England, Wales or Northern Ireland, or to Police Scotland on 101.

### Do I need to report phishing if I didn't click anything?

Yes, it still helps. Reports help your provider's filters catch similar messages, warn your IT team that a campaign is under way, and let services such as the NCSC get fake sites removed. It takes a few seconds and protects the colleagues who might click.

### How do I report a phishing email that pretends to be Apple?

Forward it to reportphishing@apple.com, which Apple lists for suspicious emails that appear to come from Apple. For ordinary spam in an iCloud, me.com or mac.com inbox, Apple says to mark it as junk instead of sending it to an address.

## Sources

- [Microsoft Learn: Report phishing and suspicious emails in Outlook for admins](https://learn.microsoft.com/en-us/defender-office-365/submissions-outlook-report-messages)
- [Microsoft Support: Protect yourself from phishing](https://support.microsoft.com/en-us/security/protect-yourself-from-phishing)
- [Gmail Help: Avoid and report phishing emails](https://support.google.com/mail/answer/8253?hl=en)
- [Apple Support: Recognize and avoid social engineering schemes](https://support.apple.com/en-us/102568)
- [Apple Support: Reduce junk mail in Mail on Mac](https://support.apple.com/guide/mail/mlhlp1065/mac)
- [FTC Consumer Advice: How to recognize and avoid phishing scams](https://consumer.ftc.gov/articles/how-recognize-and-avoid-phishing-scams)
- [CISA, NSA, FBI, MS-ISAC: Phishing Guidance: Stopping the Attack Cycle at Phase One (2023)](https://www.cisa.gov/sites/default/files/2025-03/Phishing%20Guidance%20-%20Stopping%20the%20Attack%20Cycle%20at%20Phase%20One%20508.pdf)
- [NCSC: Reporting a suspicious email](https://www.ncsc.gov.uk/collection/phishing-scams/report-scam-email)

## Free tools for this guide

- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.

---

Source: iBlockSpam, https://iblockspam.com/blog/report-phishing-email (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt