Reporting a phishing email in Gmail takes under a minute: open the message, tap the three-dot menu at the top right of the email (not the browser window), choose Report phishing, and Gmail sends the message to Google and removes it from your inbox. But that single button is only half the job — your IT team or security provider needs to know too, and Google never tells them.
Key takeaways
- Gmail's Report phishing button is in the three-dot menu on the email itself — it sends the message to Google, not to your company.
- Never action a request in a suspicious email while waiting to report it: no links, no attachments, no replies.
- The Gmail button is not a substitute for reporting to IT — pair it with a phishing report button that alerts your security team or platform.
- Report the email even if you already clicked. Speed of reporting limits the damage far more than pretending it did not happen.
Report phishing in Gmail, step by step
- Open the suspicious email in Gmail on desktop or mobile.
- Tap the three vertical dots in the top-right corner of the message itself — the menu beside the reply arrow.
- Select "Report phishing." Gmail shows a confirmation and asks whether to report the sender as well.
- Confirm. Gmail sends a copy to Google's abuse team and moves the message out of your inbox.
On the Gmail mobile app the same three-dot menu sits under the reply arrow of the open message. If the option shows "Report spam" instead of "Report phishing," use "Report phishing" when the email tried to steal credentials or money — the two labels feed different filters.
What the Gmail button does — and does not do
| Gmail's Report phishing | Reporting to your security team |
|---|---|
| Sends a copy to Google's abuse systems | Alerts the people who can act on it today |
| Improves Google's global filters | Lets IT check whether others received the same email |
| Hides the message from your inbox | Triggers investigation of real clicks or credential entry |
| No one at your company is notified | Feeds your training and human risk metrics |
Google's filter gets smarter; your company stays in the dark. That gap is the reason most security teams ask staff to use an internal reporting method in addition to the Gmail button.
The step most staff skip: tell your security team
The email that reached your inbox probably reached a dozen colleagues. Reporting it internally lets IT pull it from everyone else's mailbox, check whether anyone clicked, and warn the rest before they act on it.
- If your company runs a phishing report button, use it — in Gmail that typically appears as an extra button or add-on beside the standard Gmail controls. Cyber Aware's Gmail integration adds a one-click report button that forwards the email to your security team and logs the report.
- If you have no report button, forward the email to your IT contact or security mailbox, then delete it. Say what made you suspicious in one line.
- If you clicked or entered credentials, report immediately regardless of embarrassment — the response is faster and cheaper the sooner your team knows.
What not to do with a suspicious email
- Do not click "unsubscribe," links or attachments, even to check.
- Do not reply, even to ask whether it is real — a reply confirms your address is live.
- Do not forward it to colleagues to ask "did you get this?" — that spreads the attack internally; forward it only to IT or through the report button.
- Do not enter credentials on any page it leads to, no matter how convincing the login screen looks.
After you report
Once the email is gone, the useful part is the pattern. If you are getting recurring lures — fake invoice notices, login alerts, payroll changes — mention it when you report; recurring pretexts are exactly what good phishing simulations should be rehearsing. Program-wide, the goal is a habit: a rising report rate is the single healthiest signal a security awareness training program can show, and human risk reporting tracks it alongside click rates.
FAQ
Where is the report phishing button in Gmail? In the three-dot menu at the top right of the open email, next to the reply arrow — not in the browser's menu. On mobile it is under the same arrow.
What happens when I report phishing in Gmail? Gmail sends a copy of the message to Google and removes it from your inbox. It does not notify your employer, so also report it internally.
Should I use Report spam or Report phishing? Report phishing when the email tried to steal credentials, money or data. Report spam for unwanted marketing. They train different filters.
I already clicked the link — should I still report it? Yes, immediately, and tell your IT team what you clicked and whether you entered anything. Fast reporting is what limits the damage.
How do I report a scam to authorities in Australia? Report it to ReportCyber via cyber.gov.au, and to Scamwatch if it was a scam attempt. Both take reports from individuals and businesses.