Reporting a phishing email takes under a minute and does two jobs: it protects everyone who has not opened the message yet, and it builds the paper trail your insurer, your IT provider and the national statistics all depend on. This guide covers exactly where to report a phishing email in Australia in 2026 — inside your company first, then to the authorities — and what to do differently when money has already moved.
TL;DR
- Report internally first: use your company's report button in Outlook or Gmail so IT can pull the message from every other inbox.
- Report cybercrime to the ASD via ReportCyber; scams can also go to Scamwatch.
- If you clicked or entered credentials, the response steps come before the report — disconnect, change the password, then report.
- Never forward a live phishing email around the office; forwarding re-sends the trap. Use the report button or a screenshot.
- A fast report is the cheapest incident you will ever have: the ASD logged 84,700+ cybercrime reports in FY2024-25, roughly one every six minutes.
Why reporting matters more than deleting
Deleting a phishing email protects one person. Reporting it protects the whole business: IT can search every mailbox for the same message and remove it before a second person opens it, and the pattern gets added to the team's training. The Australian Signals Directorate received more than 84,700 cybercrime reports in FY2024-25 — about one every six minutes — and those national figures come entirely from people who reported rather than deleted (ASD Annual Cyber Threat Report 2024-25).
There is also a defensive feedback loop: platforms that run monthly phishing simulations measure report rate alongside click rate, because a rising report rate is the earliest sign the security culture is actually working. Every real report your team files is practice for the reflex that stops a real attack.
Where to report, in order
1. Inside your company — first, always
If your workplace has a report button in Outlook or Gmail (a ribbon icon that sends the message to your security or IT team), that is the single most valuable report. It attaches the full original message — headers included — so IT can hunt and delete copies across every mailbox. If there is no button, email your IT contact or manager directly, but:
- Do not forward the email. Forwarding re-sends the malicious link or attachment to another inbox.
- Instead, send a screenshot with the sender address, subject line and what looked suspicious — or attach the message as an Outlook attachment if IT asks for it.
- Say what you did with it: opened only, clicked, entered credentials, replied. The response branches on that answer.
No report button yet? That is a gap worth closing — it is usually a one-line mail-rule the IT provider adds, and platforms like Cyber Aware's training build the reporting habit into the programme.
2. To the authorities
- Cybercrime (an attack on you or your systems): report to the ASD through ReportCyber. This covers stolen credentials, account compromise, malware and ransomware. Reports feed the national picture and can unlock assistance — ASD responded to over 1,200 incidents in FY2024-25.
- Scams (someone tried to trick you): report to Scamwatch, run by the ACCC. Scamwatch publishes current scam alerts other businesses act on.
- Identity documents exposed: if your driver's licence, passport or Medicare number was exposed in a breach, IDCARE (idcare.org) provides free support for identity compromise.
- Already a victim of financial fraud: call your bank first — the recall window is measured in hours — then ReportCyber.
3. Personal accounts vs work accounts
The same structure applies to your own email: there is no internal IT team, so the report goes straight to the platform. In Gmail, use Report phishing at the top of the message; in Outlook.com, use Report phishing on the ribbon. This trains the provider's filters and protects other users of the same platform. Then delete the message. If credentials were entered, follow the incident steps before doing anything else — the report does not change your password for you.
What to include in a report
A useful report answers four questions:
- What arrived — sender address (not just the display name), subject line, and the full message if your tooling preserves it.
- What it asked for — a login, a payment, an MFA code, a document.
- What you did — deleted, opened the link, entered credentials, replied, approved a prompt.
- When — roughly when the message arrived and when you acted. Attackers use compromised mailboxes within hours, so the clock matters.
What happens after you report
Inside the company: IT searches for other copies, blocks the sender or domain, and adds the lure to the next simulation batch so the whole team rehearses it. Nothing punitive should follow for the reporter — a team that punishes reporting guarantees the next real attack goes unreported.
Nationally: your ReportCyber report joins the ASD's dataset, which is what drives the annual threat report, the alerts other businesses receive, and — when the incident is severe enough — direct response support.
If money has already moved
The order changes: bank first, everything else second. Call the fraud line on the number printed on your card or the bank's website — never a number from the suspicious email. Payments recalled within hours have a real recovery chance; after a day the funds have usually been moved on through mule accounts. Then report to ReportCyber, notify your IT provider, and preserve the original email untouched — it is evidence.
FAQ
Can I just delete a phishing email? You can, and after reporting you should delete it. Deleting without reporting leaves every other mailbox carrying the same trap and teaches the team nothing.
Is it worth reporting if I did not click anything? Yes — reports from people who spotted the scam are the fastest early warning IT gets. A spotted-and-reported email can be removed from every inbox before anyone clicks.
Where do I report a phishing text message (smishing)? Forward SMS scams to 0429 999 888, the ACCC's free reporting service, then delete. Same principle: report before you delete.
Does reporting a phishing email get anyone in trouble? No — reporting is protected and encouraged. The only staff behaviour that creates risk is hiding a click, which is why good awareness programmes explicitly promise no consequences for reports.
How fast should a report be actioned by IT? Minutes matter when credentials were entered: a compromised mailbox gets used within hours. Ask your provider what their response time is for a reported phish — if nobody can answer, a security gap assessment will surface that gap alongside the rest.
One last thing
The habit that changes the numbers is small: report, then delete — in that order, every time. Teams that build the habit see report rates climb month over month, and the next real attack gets caught by the first person who sees it.