How to Report Phishing: Step-by-Step Guide

How to Report Phishing: A Complete Step-by-Step
Guide
If you receive a suspicious email, text message, or phone call asking for personal information, a
password, or an urgent payment, the fastest way to protect yourself is to report it to your email
provider, your company's IT team, and a national cybersecurity authority. Knowing how to report
phishing quickly can stop an attacker from stealing your data, draining your bank account, or
gaining access to your workplace network before real damage occurs. This guide walks through
exactly what to do, one step at a time, across desktop, mobile, and workplace inboxes, so you
never have to guess what happens next.
Understanding Phishing Before You Report It
Phishing is a type of cyberattack where a criminal disguises themselves as a trusted brand, a
colleague, a bank, or a government institution to trick you into clicking a link or sharing sensitive
information. It usually arrives as an email, a text message, or even a phone call, and it is
deliberately designed to create urgency so that you act before you have time to think it through.
Attackers rely on fear, curiosity, or the promise of an unexpected reward to override your normal

sense of caution. Once you understand this simple psychological trick, spotting a scam
becomes much easier, and reporting it quickly becomes second nature rather than an
afterthought.
Common Types of Phishing Attacks
Not every phishing attempt looks the same, which is why it helps to know the main categories.
Spear phishing targets a specific person using personal details, while whaling goes after senior
executives with fake urgent requests. Smishing uses text messages and vishing uses phone
calls, but the underlying goal of stealing credentials or money stays exactly the same.
Warning Signs You Should Never Ignore
Most phishing attempts share a handful of telltale signs once you know where to look. A
mismatched sender address, poor grammar, or a link that does not match the company's real
domain are all classic red flags. Before you click anything, run through this quick checklist:
● Urgent language demanding immediate action, such as "your account will be
suspended"
● A sender address that looks close to real but is slightly misspelled
● Links that show a different URL when you hover over them
● Requests for passwords, one-time codes, or payment details over email
● Unexpected attachments from unfamiliar senders
How to Report Phishing Email on Major Platforms
Every major email provider has a built-in reporting tool, and using it takes less than thirty
seconds once you know the right button. When you learn how to report phishing email
through your provider's own system, the message gets flagged for their security team and often
helps filter similar scams for other users automatically. This is far more effective than simply
deleting the message, because deleting it teaches the spam filter nothing. The steps differ
slightly by platform, so let's go through each one.
How to Report Phishing in Outlook
Outlook makes reporting simple through its ribbon menu. If you want to know how to report
phishing in Outlook, open the suspicious email, click the "Report" button in the toolbar, and
select "Phishing" from the dropdown menu. Microsoft's security team reviews the submission
and uses it to strengthen spam filters for every Outlook user worldwide.
How to Report Phishing in Gmail

Gmail follows a similar process but uses a slightly different menu path. Open the email, click the
three-dot menu in the top right corner, and select "Report phishing" from the list of options.
Google's Safe Browsing team then analyzes the message and often blocks the sender across
its entire network within hours.
How to Report Phishing on Mobile Devices
Mobile apps for Gmail and Outlook include the same reporting options, just tucked inside a
slightly smaller menu. Tap the three dots at the top of the open email and look for the phishing
or "Report spam" option, since how to report phishing emails on a phone works almost
identically to desktop. Taking thirty seconds to do this from your phone protects you just as
effectively as reporting from a computer.
Reporting Phishing to Authorities and Organizations
Reporting to your email provider is only the first step, because national cybersecurity authorities
track these scams on a much larger scale. In the United States, the Federal Trade Commission
collects phishing reports at reportfraud.ftc.gov, while the Anti-Phishing Working Group accepts
forwarded emails at [email protected]. This is where learning how to report phishing to
the right authority becomes essential, since these organizations use submitted data to shut

down fraudulent domains and warn other potential victims. Every report you file adds to a larger
dataset that helps investigators spot patterns across thousands of similar attacks.
Reporting to Government Agencies (FTC, APWG)
Government-backed agencies exist specifically to track large-scale phishing campaigns and
consumer fraud. The FTC's reporting portal asks a few simple questions about what happened
and automatically shares the data with thousands of law enforcement partners. The APWG,
meanwhile, focuses heavily on analyzing phishing emails technically to identify the infrastructure
attackers reuse across multiple campaigns.
Reporting to Your Company's IT/Security Team
If a suspicious message lands in your work inbox, your company's IT or security team should
always be your first call. Most organizations have a dedicated address, like
[e-mail], or a "Report Phishing" button built directly into the company email
client. Learning how to report phishing email at work protects not just you but every colleague
who might receive the same message next.
Why Businesses Need Proactive Protection Against Phishing
Reporting individual emails is important, but businesses face phishing at a scale that manual
reporting alone cannot handle. Attackers now register lookalike domains, clone company logos,
and launch fake login pages within hours of a real campaign going live. This is why many
security teams invest in Digital risk protection services that continuously scan the internet,
dark web forums, and fake domain registrations for early warning signs. In one real-world case,
a mid-sized fintech company caught a cloned login page targeting its customers within six
hours, purely because their monitoring tool flagged the newly registered lookalike domain before
a single customer clicked it.
The Role of Digital Risk Protection Services
These platforms work by continuously monitoring the web for brand impersonation, leaked
credentials, and phishing infrastructure being built against a specific company. A good Digital
risk protection provider will alert a security team the moment a fake domain or spoofed social
media page appears, often before the attacker even sends the first phishing email. This
proactive approach shifts a company from reacting to attacks after the damage is done to
shutting them down before customers are ever exposed.
Real-Life Example: How Reporting Phishing Stopped an Attack
A university IT department once received a single forwarded email from a curious student who
noticed the sender's domain was misspelled by one letter. Because that student understood

how to report phishing instead of just deleting it, the security team traced the campaign back to
over four hundred other students who had received the identical message. Within two hours, the
fake login page was reported and taken down, and a mass password reset prevented any real
account compromise. This single report, filed in under a minute, protected hundreds of people
who never even saw the warning signs themselves.
The Real-World Cost of Ignoring a Phishing Attempt
Security researchers consistently identify phishing as one of the leading entry points attackers
use to break into both personal accounts and entire corporate networks. A single unreported
message can sit quietly in dozens of other inboxes while the same attacker refines the scam
and expands the campaign further. Delaying action, even by a day, gives criminals more time to
harvest credentials, drain accounts, or move laterally inside a company network. Treating every
suspicious message as urgent, rather than a minor annoyance, is what separates a contained
incident from a large-scale breach.
Why Delaying a Report Increases Risk
Attackers often send phishing waves in batches, testing a small group before scaling up to
thousands of targets. If the first few recipients ignore or simply delete the message instead of
flagging it, the campaign continues unnoticed for hours or even days. That extra time is exactly
what allows a single scam email to turn into a company-wide security incident.
How Reporting Protects Your Wider Network
When you flag a scam message, you are not just protecting your own inbox, you are
contributing to a shared defense system used by millions of other people. Email providers and
security vendors use these reports to update spam filters, blocklists, and threat intelligence
feeds almost in real time. A teacher who reports a scam email to their school's IT team, for
example, can end up protecting every other staff member who receives the identical message
later that same day.
Step-by-Step Checklist to Report Phishing
By now you have seen how reporting works across different platforms and authorities, so let's
bring it together into one simple checklist. Whether it lands in your personal inbox or your work
account, the process for how to report phishing emails stays largely consistent no matter
where the message arrives. Keep this list handy the next time something suspicious shows up
in your inbox. Following these steps every single time builds a habit that protects both you and
everyone in your contact list.
● Do not click any links or download attachments
● Use your email provider's built-in "Report phishing" button