A suspicious email takes under a minute to report: do not click anything, use the report button in your mail client, and if there is no button, forward it to your IT or security contact - then delete it. If you clicked a link or money has moved, there are extra steps, and this guide walks through all of them, including exactly where to report in Australia.
TL;DR
- Report internally first: the report button (or your IT contact) is what gets the email pulled from everyone else's inbox.
- In Australia, cyber incidents go to ReportCyber and scams to Scamwatch - both are free and take minutes.
- Never forward a suspicious email to colleagues as a warning: that spreads the payload and buries the real report.
- If you clicked or paid, speed decides the outcome: report within minutes and call your bank immediately if money moved.
- A no-blame culture multiplies reporting; punishing reporters guarantees the next real attack goes unreported.
Why one report matters
Most suspicious emails are caught by somebody's quick reflex, not by a filter. The Australian Signals Directorate logged more than 84,700 cybercrime reports in FY2024-25 - roughly one every six minutes - and the average self-reported cost of an incident reached $56,600 for a small business (ASD Annual Cyber Threat Report 2024-25). Nationally, scam losses hit $2.18 billion in 2025, and phishing losses rose 15.5% to $97.6 million in a year (ACCC Targeting Scams 2025).
A single early report does three jobs at once: it warns the security team, gets the message deleted from other inboxes before someone less careful opens it, and contributes to the national data that drives public warnings. The person who reports in thirty seconds is doing more for the organisation's security than any policy document.
Step 1: report it internally
- Do not click, download or reply. Even the unsubscribe link is dangerous in a phishing email. If you want a second opinion, see the phishing red flags worth checking before you touch anything.
- Use the report button. Most work email clients have one - Outlook's Report Phishing or Gmail's Report phishing. It sends the full message with its technical headers intact, which is what security teams need.
- No button? Forward it. Forward to the IT or security address your organisation publishes (often security@ or it@). Ask your provider to keep it simple: if staff cannot remember the address, reports drop.
- Delete the email after reporting. Do not keep it in a personal folder for reference.
If your workplace runs phishing simulations, the report button you practise there is the same one you use on a real attack - which is exactly why the rehearsal exists.
Step 2: report it externally
Internal reporting protects your team; external reporting protects everyone else and creates the official record you may need later:
- ReportCyber is the Australian Cyber Security Centre's reporting service for cybercrime - incidents, compromises and ransomware. Use it when credentials may have been stolen, an account was accessed, or money was lost.
- Scamwatch, run by the ACCC's National Anti-Scam Centre, takes scam reports - including the fake-invoice and payment-redirection emails that target businesses.
You do not need to be certain an email was malicious to file a report. The systems ask questions; a report made in good faith is never a problem.
What to include in a report
- The email itself, with headers if your mail client can export them (the report button does this automatically).
- What you did before reporting: opened it, clicked a link, entered details, or just read it.
- Timing: when the email arrived and when you noticed it.
- Any financial details if money is involved - the amount, the recipient, and whether your bank has been called yet.
What not to do
- Do not forward it to colleagues as a warning. If the email carries malware, you have just distributed it. If it is part of a campaign, the security team needs to see it from one reporter, not forty.
- Do not call a phone number printed in the email to check whether it is genuine - it belongs to the sender. Look the number up independently.
- Do not reply, even to say no. A reply confirms your address is live and monitored.
- Do not sit on it because you might be wrong. A false alarm costs a security team minutes; a late report can cost an organisation its money.
If you already clicked or paid
- Clicked a link or entered a password: report it immediately and change that password from a different device - then anywhere you reused it. Tell IT so they can check for follow-up activity.
- Money has moved: call your bank first, then report to ReportCyber. Transfers recalled within hours have a real recovery chance; after a day the money is usually gone.
- A supplier's bank details changed: treat it as fraud until verified by phone on a number you already hold. Payment redirection is one of the fastest-growing loss categories in Australia.
Make reporting the default
Reporting rates are a culture number, not a technology number. Teams report quickly when three things are true: reporting takes one click, the reporter is thanked rather than interrogated, and nobody has ever been punished for a report. If your report rate is below 10% of people, the problem is the process, not the people - human risk reporting shows the report rate per month so you can watch it respond to changes. For the culture side, our guide to reporting a phishing email covers the internal workflow in more detail, and security awareness training rehearses the habit monthly.
FAQ
Should I report an email I am not sure about? Yes. Reports are cheap and false alarms are expected. The only expensive report is the one that arrives after money has moved.
What is the difference between ReportCyber and Scamwatch? ReportCyber (ACSC) takes cybercrime incidents - stolen credentials, account compromise, ransomware. Scamwatch (ACCC) takes scam reports, including fraudulent invoice and payment-redirection emails. When in doubt, report to both.
Is forwarding the email to IT safe? It is acceptable when there is no report button, and it is how most organisations still work. The report button is better because it preserves the message's technical headers automatically.
What happens after I report? Internally: the security team blocks the sender, pulls the message from other inboxes and tells everyone what to watch for. Externally: the report feeds national threat data and may trigger a Scamwatch alert.
One last thing
Put the two reporting links - ReportCyber and Scamwatch - in your browser bookmarks today. The organisations that lose the least to phishing are not the ones with the best filters; they are the ones where reporting a suspicious email takes thirty seconds and never feels risky.