You report a phishing email from inside your mail app: in Gmail, open the message, click the three-dot menu and choose Report phishing; in Outlook on the web, use Report > Phishing in the toolbar; in Apple Mail, select the message and use Mark as Junk or forward it to Apple's reportphishing@apple.com address. Each route feeds a different filter, and none of them replaces changing a password if you already clicked. This guide covers where the buttons live, what forwarding to the impersonated company achieves, and what reporting actually does behind the scenes.
Why reporting matters more than deleting
Deleting a phishing email protects only you, and only for that one message. Reporting it feeds a filter that other people rely on. Mail providers train spam and phishing classifiers on user reports, so a message that several people flag is more likely to be blocked for everyone else before they see it.
The same logic applies to the brand being impersonated. Banks, delivery firms and cloud providers run abuse desks that chase down the domains and hosting used in phishing campaigns. A report to them can get a fake login page taken offline, even if your own provider had already caught the message.
Reporting is not a substitute for the basics. If you have already entered credentials, reporting is the second thing you do; changing the password and revoking sessions is the first. Our guide on how to spot a phishing email covers the signs worth checking before you click anything.
How do you report a phishing email in Gmail?
Gmail gives you two related options, and they are not the same. Report spam teaches the spam filter; Report phishing flags the message as a deliberate deception attempt and sends it to Google's security team for review.
- Open the message in Gmail on the web or in the mobile app.
- Click or tap the three-dot menu next to the reply button.
- Choose Report phishing. On mobile, the option may sit under a More menu.
Google's own help page, Report phishing emails, describes this flow and notes that reported messages may be reviewed by their team. On the web you can also select several messages at once and report them together, which is useful after a campaign hits your inbox in bulk.
If you use Gmail through Google Workspace, your administrator may have added a third-party reporting button (often from a security vendor) that appears alongside the standard menu. Use whichever your organisation has told you to use; the admin route usually produces better internal tracking than the consumer menu.
What about the "Report spam" button?
Use Report spam for ordinary unwanted mail and Report phishing for messages pretending to be someone they are not. Reporting a genuine phishing attempt as spam still helps, but it does not trigger the same review path. When in doubt, phishing is the safer label: a false positive is a minor inconvenience, while a missed phishing report is a missed warning for everyone else.
How do you report a phishing email in Outlook?
Outlook has changed its reporting layout several times, so the exact wording depends on whether you are on the web, the new Outlook for Windows, classic Outlook or the mobile app. The general pattern is consistent.
- Outlook on the web: open the message, then use Report > Report phishing in the toolbar above the reading pane.
- New Outlook for Windows: the same Report menu appears in the ribbon; choose Phishing.
- Classic Outlook: you may need to add the Report Message add-in from the ribbon's add-in store, after which a Report button appears.
- Outlook mobile: open the message, tap the three-dot menu and choose Report junk > Phishing.
Microsoft's support pages on reporting junk and phishing mail explain that reports go to Microsoft for filtering and, in organisational accounts, to your administrator. If you use a work or school account, your IT team may prefer you use their own reporting tool instead, because it captures more context for investigation.
Does reporting in Outlook delete the message?
Not always. In many configurations the message stays in your inbox until you delete it, and in some it moves to your Junk Email folder. If you have already opened it and are worried, delete it manually after reporting. Deleting before reporting is the wrong order: the report is more useful while the message is still in your mailbox.
How do you report a phishing email in Apple Mail?
Apple Mail on iPhone, iPad and Mac does not have a dedicated phishing button in the same way Gmail does. The practical routes are:
- Mark as Junk: select the message and tap or click the junk icon. This trains Apple's filter on your device and account.
- Forward to Apple: send the message as an attachment to
reportphishing@apple.com. Apple's support page Recognise and avoid phishing messages, phoney support calls and other scams documents this address and asks you to include the full message rather than a screenshot. - Report to iCloud: if the message arrived at an iCloud address, the same Apple address is the correct destination.
Forwarding as an attachment matters. A plain forward strips the original headers, which are the evidence Apple and other abuse desks use to trace the sender. On iPhone, press and hold the message in the list, choose Forward, and the message should be included as an attachment rather than inline text.
What does forwarding to the impersonated company achieve?
Most large brands publish an address for reporting abuse, and many now accept phishing reports at a dedicated mailbox. A bank, for example, will typically have an address such as phishing@ or abuse@ on its official domain, listed on its security or contact page. Forwarding there helps in three ways:
- It gives the brand's abuse team the exact message, including headers, so they can trace the fake domain and request takedown.
- It helps them warn other customers if a campaign is spreading.
- It can get a fraudulent login page removed from a hosting provider before more people enter credentials.
Always verify the address on the company's own website by typing the domain yourself. Do not use an address printed inside the suspicious email, because that is exactly the kind of detail a phisher will fake. If the company has no published address, use its general contact form and describe the message; do not guess.
Forward as an attachment where your mail app allows it, and never forward by copying the body text into a new message. The headers are the useful part.
National reporting addresses: only where you are certain
Several countries run national reporting channels for phishing and fraud. They are genuinely useful, but the addresses and portals change, and a wrong address sends your evidence nowhere. Rather than list them here, where they could go stale, use this rule: find the reporting page by navigating from the national cyber-security agency's own website, not from a search result or a link in an email.
In the UK, the National Cyber Security Centre publishes a Report a phishing attempt page that explains the Suspicious Email Reporting Service. In the US, the Cybersecurity and Infrastructure Security Agency publishes guidance on reporting to the FBI's Internet Crime Complaint Center. In Australia, the Australian Cyber Security Centre runs ReportCyber. In each case, start at the agency's homepage and follow the reporting link from there.
National reporting is most valuable when money or credentials are already involved. For a message you spotted and deleted, your mail provider's report button is usually enough.
What reporting actually does
It helps to be honest about the limits. Reporting a phishing email does not usually produce a personal reply, a case number or a visible outcome. What it does is feed a pipeline:
- Filter training: your report becomes a labelled example that improves classification for other users.
- Domain and URL blocking: providers add the sender's domains and links to blocklists, often within hours.
- Takedown requests: brands and providers ask hosts and registrars to remove fraudulent pages.
- Investigation: repeated reports from many users can trigger a formal review, especially for a campaign targeting a specific organisation.
What it does not do is undo a click. If you entered a password, change it immediately, turn on two-factor authentication if it is not already on, and check for forwarding rules or app passwords an attacker may have added. Our guides on two-factor authentication and what to do after a data breach cover the recovery steps in order.
When a disposable address is the right move
Reporting is a response to phishing that reached you. Reducing how often it reaches you is a separate habit. If you are signing up for a one-off download, a trial or a forum you may never return to, a disposable inbox keeps your real address out of the dataset that phishers buy and trade.
That is the case MailboxTemp is built for: a random address that lives for 60 minutes by default, extendable in ten-minute steps, with one-time codes detected automatically. It is receive-only, so it is not a route for reporting anything, and it is not a substitute for a real mailbox where account recovery matters. Our comparison of temp mail, VPNs and aliases explains which tool fits which job. If you want to try it, the how it works page sets out the limits plainly.
For accounts you care about, a real address with two-factor authentication is the right choice, and reporting phishing from it is exactly what the buttons above are for.
Sources
- Google Support: Report phishing emails — support.google.com/mail/answer/8253
- Apple Support: Recognise and avoid phishing messages, phoney support calls and other scams — support.apple.com/en-gb/102568
- Microsoft Support: Deal with abuse, phishing, or spoofing in Outlook.com — support.microsoft.com
In short
Report phishing from inside your mail app: Gmail's three-dot menu, Outlook's Report button, Apple Mail's junk control or reportphishing@apple.com. Forward to the impersonated company only at an address you verified on its own site, and treat national reporting as a step for cases where money or credentials are already at risk. Reporting feeds filters and takedowns rather than producing a personal reply, so pair it with a password change if you clicked. And where you simply do not want to hand over your real address, a disposable inbox is the quieter fix.