How to report a phishing email, and make it easy for your team.

To report a phishing email, use the Report button in Outlook or Gmail and forward the message to report@phishing.gov.uk, the National Cyber Security Centre’s reporting address. That covers the outside world. Inside your business, the email also needs to reach whoever can check if anyone else received it, and that’s the part most teams haven’t set up.

This guide covers both: where to send a report today, and how to give your team one simple route they’ll use every time.

Where to send it

What you’ve got	How to report it
Email in Outlook	Select the message, choose Report in the toolbar, then Report phishing.
Email in Gmail	Open the message, select the three dots next to Reply, then Report phishing.
Any suspicious email	Forward it to report@phishing.gov.uk. The NCSC checks reports and can have scam websites taken down.
A suspicious text	Forward it to 7726. It’s free and goes to your mobile network.
You’ve lost money or paid a fake invoice	Call your bank first, then Report Fraud on 0300 123 2040. Our invoice fraud guide has the steps.

Not sure if it’s phishing at all? The 30-second check will help you decide. If in doubt, report it anyway.

Why one report matters to everyone else

Phishing emails rarely arrive alone. If one person in accounts has it, three others probably do too, and one of them is reading it on a phone between meetings. The first report is your early warning. It gives someone the chance to pull the email out of the other inboxes before it’s opened.

That only works if reporting is quicker than deleting. People delete because it’s one click and nobody asks questions afterwards. Reporting has to be just as easy.

Set up one route for your team

1. Pick one way to report. The Report button is the easiest because it’s already there. In Microsoft 365, an admin can have those reports copied to a mailbox you choose: in the Microsoft Defender portal, look for User reported settings under Email & collaboration. On any other system, a shared address such as phishing@yourbusiness.co.uk does the same job.
2. Name who looks at reports. One person, plus someone to cover holidays. If you have an IT provider, agree that reports go to them and how quickly they’ll look.
3. Tell people what happens next. Someone will check it, usually the same day, and reply either way.
4. Say thank you, including for false alarms. A real invoice reported by mistake costs you two minutes. A fake one that nobody mentioned can cost a great deal more.
5. Make “I clicked it” safe to say. The sooner you hear, the more you can do. Anyone who owns up quickly has done you a favour, and they should hear that from the top.

A note you can send your team

If an email looks odd, please don’t just delete it. Select Report, then Report phishing. That sends it to [name], who’ll check it and let you know. If you’ve already clicked a link or typed your password, tell [name] straight away on [phone]. You won’t be in trouble. The quicker we know, the easier it is to sort out.

When a report lands with you

• Don’t click the links or open the attachment to “see what it does”.
• Find out who else received it. In Microsoft 365 and Google Workspace an admin can search every mailbox for the sender or subject.
• Remove it from the other inboxes and block the sender.
• Tell the team in a sentence: what it looked like, and that it’s been dealt with.
• If anyone entered a password, change it, sign them out everywhere and check for new forwarding rules. Our guide to a hacked business email walks through it.
• Reply to the person who reported it.

Once the route is in place, it’s useful to know how it holds up. fromIT runs phishing tests that show how many people report a realistic email and how quickly the first report arrives.

FAQ

Does forwarding to report@phishing.gov.uk actually do anything?

Yes. The NCSC analyses what’s sent in and works with hosting companies to remove scam websites. It won’t reply to you about each email, and it doesn’t replace reporting inside your own business.

Should we report every bit of spam?

No. Marketing you didn’t ask for is junk, and the Junk button is fine for that. Report anything that asks for a password, a payment, a change of bank details or an urgent favour.

What if someone already clicked the link?

Report it anyway and say so. Clicking on its own is often harmless. Typing a password or opening an attachment needs a quick response, so the hour it’s reported in matters.

Should staff be disciplined for clicking?

We’d advise against it. People who expect a telling-off stay quiet, and you find out days later. Thank the reporters and fix the gap the email got through.