How to report a phishing email in Outlook, Gmail and iPhone Mail

Report it, then delete it

Reporting a phishing email takes a few seconds. It does not get your money back and it does not stop that sender on its own, but it helps your email provider catch the same email in other people's inboxes. It also puts the scam on record with groups that track it.

Two rules before you start:

• Don't reply, and don't click anything in it, including an "unsubscribe" link.
• Use the report button in your email app first. Forward it only to the addresses below that ask for it, and to nobody else.

Not sure it is phishing? Run the six checks in "Is this email a scam?" first.

Outlook (Outlook.com and the new Outlook)

Microsoft's steps (Microsoft):

1. Select the message.
2. Above the reading pane, select Report, then Report phishing.

Microsoft adds one thing people don't expect: "the sender is reported but is not blocked from sending you additional messages." To stop that sender, also add them to your blocked senders list.

In the Outlook app on a phone (Microsoft): select the email, tap ⋮ at the top right, choose Report Junk, then Phishing.

A work or school Outlook account may have its own "Report" button set up by your organization. If you are not sure, tell your IT or security team. They would rather hear about it from you than find out later.

Gmail

Google's steps on a computer (Google):

1. Open the message.
2. Next to Reply, click More.
3. Click Report phishing.

Worth knowing while you are there: Google says "Gmail won't ever ask you for personal information, like your password, over email." An email that does is not from Google.

Apple Mail and iCloud Mail on iPhone, iPad and Mac

• If the email pretends to be from Apple (a fake Apple ID, iCloud or App Store message), forward it to [email protected]. That is the address Apple asks for (Apple).
• Any other spam or phishing in iCloud Mail: Apple's advice is to "mark the spam emails as Junk or move them to your iCloud Junk folder" (Apple). That trains iCloud's filter.
• If your iPhone's Mail app shows a Gmail or Outlook account, the phishing report goes to that provider. Open the email in the Gmail or Outlook app, or on their website, and report it with the steps above.

Two more places to send it

• The Anti-Phishing Working Group. The FTC's advice for any phishing email is to "forward it to the Anti-Phishing Working Group at [email protected]" (FTC).
• The company being faked. Many companies have their own address for this. PayPal, for example, asks for fakes at [email protected] (PayPal). Look for it on the company's official website, not in the email.

If you clicked, typed a password, or paid

Reporting is for the email. If it already got something from you, act on that first:

• You typed a password: change it now, on the real site typed by hand, and anywhere you use the same password. Turn on two-step verification.
• You paid or gave card details: call your bank or card issuer straight away and ask them to stop or reverse the payment (FTC).
• You lost money or personal information: report it to the FTC at reportfraud.ftc.gov.

Check the link without opening it

If the email had a link and you want to know where it really goes, paste it into our checker instead of clicking. We open it in a separate browser, follow every redirect, and tell you what is at the end: a login form, a payment page, a download, or how new the site is.