How to Report a Phishing Email in Gmail and Outlook

Delete a phishing email and you protect yourself. Report it and you protect a few thousand strangers as well. That is the whole argument of this page: reporting is the one click that protects everyone else, not just you. Deleting ends the story at your inbox. Reporting feeds the message to the filters at Google and Microsoft and into the takedown pipelines that shut campaigns down.

Why the report matters more than the delete

A phishing campaign runs on volume. One wave hits thousands of inboxes in an afternoon, while the link is fresh and the filters have not seen it yet. Every report teaches the filter what this wave looks like. The faster the filter learns, the shorter the wave lives.

The numbers back this up. The US Federal Trade Commission says email was the number one way scammers reached people in 2024. Google's own help page says that when you report in Gmail, it receives the message and can analyse it and its attachments to protect users from spam and abuse. Microsoft says the same about its end: the report reaches its security systems and improves the filters, so everyone sees fewer of these messages.

And the report does not stop at the provider. The UK's National Cyber Security Centre says it has removed 454.8k scam URLs as of July 2026, working from emails the public forwards to it, and it confirms it acts on every message received. The Anti-Phishing Working Group runs the clearinghouse that security firms and law enforcement use to track campaigns. The FTC shares reports with more than 2,000 law enforcement partners. One email, several machines, all of them real.

Report it in Gmail

Google's documented steps, from its own help page:

1. On a computer, open the message. Read it. Touch nothing inside it.
2. Click More (the three dots) next to the Reply button.
3. Click Report phishing. Gmail asks you to confirm; confirm.

The message leaves your inbox and Google gets a copy to analyse. That is the entire procedure.

One note on where this is documented: Google's page describes the computer path. The mobile app has the same reporting options, but if your version lays them out differently, the desktop steps above are the ones Google guarantees. And if the email was never flagged and sits in your inbox looking ordinary, that is exactly when the manual button earns its keep. Reporting an unflagged message is what it is for.

Gmail also puts warnings on messages it already suspects. Those warnings deserve respect. Google's rule on its own page is plain: pay attention to them, and never enter your password after clicking a link in a message. If a security email looks like it came from Google and you are not sure, open your Google account's security page yourself and check recent activity there, instead of trusting the email.

Report it in Outlook

Microsoft's current steps for Outlook.com, from its own help page:

1. In the message list, select the message. You can select several at once, and you do not need to open it.
2. Above the reading pane, select Report, then Report phishing.

Microsoft 365's desktop app uses the same path: select the message, then Report > Report phishing from the ribbon. Microsoft's page covers both the classic and simplified ribbon layouts, so whichever one you have, the steps hold (its broader guide repeats them).

Two things worth knowing. The reported message is removed from your inbox. And reporting does not block the sender: Microsoft says this directly, and to stop that address reaching you again you add it to your blocked senders list separately.

Report it from the alias that received it

Most reporting guides miss this part. That is the reason this piece is on an alias blog.

When you report a phishing email, one of the most useful facts in the report is where the message landed. If you use one email alias per site, the receiving address names the source. A "bank" email arriving on the alias you gave only to a bookshop has convicted itself before you read a word. It also tells the report something specific: the address that escaped came from the bookshop.

Each alias is a separate forwarding address tied to one site, so the To field on a phishing email is a record of who held that address (the leak-tracing piece walks through how that works). In a report, that attribution is evidence. It says the campaign is working from a list that leaked out of a specific place. That is precisely what the takedown teams need to trace a campaign to its source.

So report from the alias. Do not tidy the email first: the headers and the receiving address are the useful part. If you want this machinery in place before the next wave, the set-up guide takes a couple of minutes, and you can start with the ten free aliases on AliasFleet.

Send it to the people who take campaigns down

The provider buttons feed filters. These addresses feed the people who remove the infrastructure. The cheat sheet:

The details behind the table:

• United States: forward the phishing email to the Anti-Phishing Working Group at reportphishing@apwg.org, then file the attempt at ReportFraud.ftc.gov. That is the FTC's own guidance, spelled out in its consumer alert.
• United Kingdom: forward suspicious emails to report@phishing.gov.uk. The NCSC's reporting page asks you not to bother with anything already sitting in your spam folder, and the wider GOV.UK guidance lists 7726 for scam texts too.
• Tech support scams: Microsoft runs a dedicated form at microsoft.com/reportascam for scammers posing as Microsoft or another tech company.
• If you use a client other than Outlook: Microsoft asks you to attach the phishing message (never forward it) to a new email to phish@office365.microsoft.com, so it can examine the original headers. That is the documented route on Microsoft's own support page, and the APWG is where the attached message counts most for campaign tracking.

What never to do with it

Short list. All of it matters.

1. Do not click anything inside the email. Not the links, not the attachments, and not even the unsubscribe link. Google's rule is blunt: never click links from strangers or untrustworthy sources. An unsubscribe click on scam mail confirms your address is live, and the spam-harvesting piece explains why live addresses are the ones that get traded.
2. Do not reply. A reply confirms the address is active and hands the attacker a sample of your writing. Microsoft's advice on the same page: never use anything inside the message to verify the message.
3. Do not forward it to your contacts as a warning. A normal forward sends live, clickable links to your friends. If you want to warn someone, send a screenshot with the links broken or typed out, and tell them to verify through the company's own app. The phishing-check guide covers the verification drill. And if you are tempted to post the email online, crop your own address out first. A screenshot with your address visible puts it one more place where it can be harvested.
4. Do not enter your password after clicking a link. If you already clicked through to a login page, close it and go to the site by typing the address yourself. Google's help page states this exact rule for Gmail users.

Never use a phone number, link, or reply address inside a suspicious message to verify that message. They all lead back to the attacker. Verify through a route the message cannot touch: the company's app, a number on your card or statement, or an address you type yourself into a fresh browser tab.

Already clicked something?

Act now, in this order:

1. Close the page. Enter nothing more.
2. If you entered a password, change it on the real site (typed by you, not linked), then everywhere else you reused it. Turn on two-factor authentication.
3. If you shared payment details, call your card issuer on the number printed on the card.
4. If a work or school account was involved, tell your IT support people about the possible attack. Microsoft lists this as a step on its own page, and it matters because the attacker may have moved sideways into your workplace. If money changed hands or identity data was handed over, report it to local law enforcement too.
5. Check Have I Been Pwned to see what else is circulating, then run the leak check properly and work through the full breach-response checklist.

Said plainly, since nobody else will say it: I honestly cannot tell you whether your single report took down one specific campaign. Nobody can, and anyone who promises otherwise is guessing. What the numbers show is that the machinery your report feeds is real: hundreds of thousands of scam URLs removed, filters retrained, reports shared with thousands of investigators. The click is small. The machinery behind it is not.