How to report a phishing email

Before you report

• Do not click links, reply or open attachments.
• Do not forward the message to colleagues or friends as plain text. Use the report button, or attach the original as a file.
• If you clicked a link or entered a password, deal with that first: see what to do if you clicked a phishing link.
• For agencies that want the original, save the message as an .eml file. It keeps the headers.

In Gmail

1. Open Gmail in a browser on a computer and open the suspicious message.
2. Next to the Reply button, click More (three dots).
3. Click Report phishing.

Reporting sends Google a copy of the message and any attachments, which Google may analyse to protect users from spam and abuse. If Gmail flagged a genuine message by mistake, use the same menu and choose Report not phishing.

In Outlook

• Outlook on the web and Outlook.com: select the message, then choose Report and Report phishing above the reading pane.
• Classic Outlook for Windows: open the message, choose Report message on the ribbon, then Phishing. This comes from an older Microsoft article, so the ribbon may look different in your version.
• Outlook for Android and iOS: select the email, tap the three dots at the top right, choose Report Junk, then Phishing.

Reporting a sender does not block them. To stop further mail, also add the sender to your blocked senders list.

To the company being impersonated

Banks, couriers and online services run abuse teams and often publish a dedicated address or form for phishing. Look on the brand's own website, usually under security, fraud or contact, rather than using an address from the suspicious message. Sending the original .eml helps them trace the campaign.

If the message impersonates your bank and you shared card, login or other details, call the bank using the number on your card or its official site.

In Poland: CERT Polska

CERT Polska, which runs inside NASK, takes reports of phishing emails, text messages and fake websites.

Phishing email

1. Save the message as an EML or MSG file, or forward it as an attachment in that format. CERT Polska says this keeps the body, attachments and original headers, which it uses to check the message route and SPF, DKIM and DMARC. Screenshots usually do not allow a proper analysis.
2. Open incydent.cert.pl and choose the suspicious email form. The file upload appears after you solve the captcha.
3. Keep the reference number you receive.

You can also send the report to [email protected], the address gov.pl gives for suspicious emails and websites. If the email links to a fake site, report that domain as well through the malicious domain form, with the full URL of the harmful page.

Suspicious text message

1. Forward the SMS to 8080 with your phone's Forward or Share option. If your phone cannot forward, copy the whole text and send it to 8080.
2. Send it unchanged: do not cut out the link and do not add comments.

Sending to 8080 is free in Poland. The service takes up to 3 messages from one number within 4 hours. Abroad your operator's normal rate applies.

Elsewhere: international options

In the UK, if you lost money, tell your bank straight away and report it to Report Fraud (Police Scotland, 101, in Scotland). The NCSC says not to use its email address to report a crime.