How to report phishing emails in Gmail, Outlook, Yahoo and Apple Mail
Knowing how to report phishing emails takes less than a minute to learn, and it does more than deleting. A report teaches your mail provider to filter that message for everyone, gets fake websites taken down, and gives the impersonated company evidence. There are up to three places to report to: your email app, the company being imitated, and the authorities. The first is the one that matters most.
How to report phishing in Gmail
- Open the email on a computer.
- Click the three dots at the top right of the message, next to the reply arrow.
- Choose Report phishing.
In the Gmail app on a phone there is no separate phishing option: tap the three dots at the top of the screen and choose Report spam. Google checks spam reports for phishing as well.
How to report phishing in Outlook
- Outlook.com and new Outlook: select the message, click Report in the toolbar and choose Report phishing.
- Classic Outlook: use the Report button on the Home ribbon. At work this often sends a copy to your security team too.
- Outlook mobile: open the message, tap the three dots and choose Report junk > Phishing.
How to report phishing in Yahoo Mail
Select the email and click Spam. On some versions the three-dot menu also offers "Report a phishing scam". Either one sends the message to Yahoo's filters.
How to report phishing in Apple Mail and iCloud
Apple Mail has no report button. Forward the message:
- Emails pretending to be from Apple: forward to reportphishing@apple.com.
- Spam or phishing received at an iCloud, me.com or mac.com address: forward to abuse@icloud.com.
On a Mac, select the email and choose Message > Forward as Attachment, which keeps the technical headers that investigators need.
Report it to the company being impersonated
Forward the email to the real company's abuse address. Type the address yourself; never use one given in the suspicious message.
| The email pretends to be from | Report it to |
|---|---|
| Amazon | reportascam@amazon.com, or amazon.com/reportascam |
| PayPal | phishing@paypal.com |
| Apple | reportphishing@apple.com |
| Microsoft | phish@office365.microsoft.com |
| The IRS | phishing@irs.gov |
| USPS | spam@uspis.gov |
| Your bank or card | The fraud address on the bank's own website, or the number on the back of your card |
Report it to the authorities
- Anti-Phishing Working Group: forward the email to reportphishing@apwg.org. Banks, providers and security companies share this feed.
- FTC: file a report at ReportFraud.ftc.gov.
- FBI: if you lost money or gave away personal details, also report at ic3.gov.
- Phishing by text message: forward the text to 7726 (SPAM), which works on the major US carriers.
- Outside the US: in the UK forward to report@phishing.gov.uk; Canada has the Canadian Anti-Fraud Centre; Australia has Scamwatch.
What happens after you report
You usually won't get a reply, and that's normal. Your report is combined with thousands of others. Providers use them to block the sender and similar messages; browsers add the fake site to their warning lists; hosting companies take pages down, often within hours. A single report rarely leads to an arrest, but the volume of reports is what shortens the life of each scam.
If you already clicked or entered a password
- Change that password right away, on the real site, and anywhere else you used the same one.
- Turn on two-step verification for the account.
- If you entered card or bank details, call the bank using the number on your card.
- If you opened an attachment, run a full antivirus scan.
- If it was your email password, follow the steps in how to recover a hacked Gmail account and check for the signs of a hacked inbox.
In the US, IdentityTheft.gov builds a recovery plan based on exactly which details were exposed.
How to be sure it is phishing
You don't need to be certain before reporting; providers check for themselves. The usual signs are a sender address that doesn't match the company, pressure to act within hours, and a link that leads to a different domain from the one shown. See how to spot a phishing email and how to check if an email is real for a fuller checklist. Specific scams have their own tells, such as fake invoices and sextortion emails.
Common questions
What is the difference between reporting spam and reporting phishing?
Spam is unwanted advertising. Phishing is an attempt to steal passwords, money or personal data by pretending to be someone else. Reporting phishing triggers stronger action, including warnings on the linked website.
Should I forward a phishing email to my friends to warn them?
No. Forwarding spreads the live links. Send a screenshot or describe it in your own words.
Should I delete the email after reporting?
Yes, unless you lost money. In that case keep it as evidence for your bank and the police.
Is it worth reporting if I didn't fall for it?
Yes. The same message went to thousands of other people, and the report helps block it for them.