Act this weekWhat happenedOfficial guidance explains how to report phishing emails: use your mail app's report option, forward to anti-phishing groups, and tell the FTC.
Who is affectedAnyone with an email account, including Gmail and Outlook users, and small businesses whose staff get fake bank, shop or delivery messages.
What to do- 1Do not click links or open attachments in the message.
- 2Report it with your mail app's report option, then forward it to reportphishing@apwg.org.
- 3Report it to the FTC at ReportFraud.ftc.gov, then delete the email.
- 4Contact the company only through a phone number or website you already know is real.
Got a fake bank, shop or delivery email? Reporting it takes under a minute, and official guidance is clear on where it goes. In the US, forward it to reportphishing@apwg.org, run by the Anti-Phishing Working Group, and report it at ReportFraud.ftc.gov. Scam texts can be forwarded to 7726, which spells SPAM on a phone keypad.
Why a quick report matters
A phishing email pretends to come from a bank, a shop, a delivery firm, a government office or your employer. It tries to get you to click a link, open a file or type private details. Mail providers and public bodies use reports to warn other people. In some cases they also use them to ask hosting companies to take the linked sites down. One report from you can help protect people you will never meet.
The question to ask first
The FTC suggests asking: do I have an account with this company, or do I know this person? If not, do not click anything. Report the message and delete it. If you do have an account, do not use the contact details in the message. Use a phone number or website you already know is real, such as the one on your card. The FTC also notes that legitimate companies do not send payment update links by email or text.
Who can relax
If you spotted the message and never clicked, opened a file or replied, you are in good shape once you report and delete it. Reading the text is safe enough, according to the guidance. The risk starts when you open what it points to. The NCSC, the UK's cyber agency, also says you can send as many suspicious emails as you like.
What to watch for
- Messages from a company you have no account with.
- Links asking you to update a payment or confirm details.
- Phone numbers printed in the message. Do not call them.
- Offers to pay for a tool that removes phishing emails. Skip them.
Do not reply, even to say stop. Never send card or ID numbers by email. The steps in the alert box above cover the order to follow.
What is not confirmed
Some details are still unclear. Outlook menu paths could not be confirmed, so look for a Report or Report phishing item in your app's toolbar or message menu. The Gmail steps checked were for a computer, not a phone. In the UK, the published NCSC address is report@phishing.gov.uk, but check it on the NCSC page before sending. Reporting routes for other countries have not been confirmed.
The takeawayDo not click anything in a suspicious message. Report it in your mail app, forward it to reportphishing@apwg.org, tell the FTC, then delete it.