Reporting a suspicious email takes thirty seconds and protects every colleague who receives the same attack. This is the step-by-step guide to follow at work — including what to do if you already clicked.
Key takeaways
- Use the Report phishing button in Outlook or Gmail first; it sends the email to your security team with everything they need.
- Never forward a suspected phishing email normally — attachment and link analysis works on the original, and forwarding can trigger the payload.
- If you clicked or entered a password, act immediately: report it anyway, change the password, and tell your manager. Nobody gets fired for reporting fast.
- Report even when you are not sure. A false alarm costs your IT team a minute; an unreported phish can cost the business its trust account, client data or a week of downtime.
Why reporting beats deleting
Deleting a phishing email protects only you. Reporting it lets your security team block the sender across the whole organisation, pull the same message from other inboxes, and warn the colleagues who already clicked. Most businesses that suffer a serious email compromise had someone who saw it coming and said nothing — usually because they were not sure it counted, or did not know how. It counts, and here is how.
How to report a suspicious email: step by step
Step 1: Stop. Do not click anything in the email. No links, no attachments, no "unsubscribe", no scanning the QR code. If the email feels off — urgency, unexpected invoice, unusual sender address, a request to change bank details — treat it as suspicious until proven otherwise.
Step 2: Use the report button.
- Outlook: select the email, then click Report phishing (or Report junk) in the ribbon, or the Cyber Aware report button if your company uses one.
- Gmail: open the email, click the three dots, choose Report spam, or use your company's report add-in if installed. The button sends the original email, intact, to the people who can act on it.
Step 3: If there is no button, contact IT directly. Send a short message — subject line, sender address, why it looks suspicious — and attach the suspicious email as an attachment rather than forwarding it inline. If you use Cyber Aware or a similar tool, the report button does this automatically and credits you for reporting.
Step 4: If you already clicked or entered details, act now — do not wait.
- Report it immediately, as above — say plainly that you clicked.
- Change the password for the affected account, and any other account that shares it.
- If you entered payment or bank details, tell your manager and finance so the payment can be stopped.
- Follow IT's instructions — they may reset sessions or check the account for forwarding rules. Speed matters: an account compromise reported in minutes is usually contained; one reported the next day rarely is.
Step 5: On your phone, same rules apply. Use the report action in the Outlook or Gmail mobile app. If there is none, forward the email as an attachment from your computer later, or tell IT the sender and subject. Never tap the link "just to check".
Step 6: Report even when you are unsure. A well-intentioned false alarm is always welcome. Security teams tune the guidance from the reports they receive — the reporting habit, not the individual email, is what they are building.
What happens after you report
Your report lands with IT or the security platform. Typical actions within the hour: block the sender across the company, search every mailbox for the same message and remove it, check whether anyone else clicked, and update email filtering so the next variant is caught automatically. In a good programme you get a short "thanks — handled" back, and if it was a phishing simulation, a two-minute coaching page instead of a lecture.
What not to do
- Do not reply to the email, even to tell the sender off — replies confirm your address is live.
- Do not forward it to colleagues to ask "is this real?" — you are delivering the phish to more targets. Ask IT.
- Do not test the link in an incognito window. Modern phishing kits capture details and adapt; curiosity is how credentials leak.
- Do not delete the original before reporting — the report button needs it.
For managers: make the habit stick
Reporting rates are the metric that predicts whether your business catches the real one. Make reporting one click away, thank reporters publicly, run a monthly phishing simulation so the reporting path gets practised, and never discipline a fast report. Track the numbers with human risk reporting — the trend that matters is reports going up as clicks go down.
Related questions
Should I delete a phishing email after reporting?
After your security team confirms, yes — deleting keeps the temptation out of your inbox. Before confirmation, leave it: IT may need the original for analysis.
What if I reported and nothing happened?
Follow up with IT after a day if the same sender keeps emailing you. Reporting systems occasionally miss messages that arrive through unusual routes — a nudge gets it blocked.
Can I get in trouble for clicking a phishing link?
In a well-run programme, no — fast reporting is rewarded, not punished. Hiding a click is the behaviour that turns a small incident into a breach. See how a no-blame reporting culture works.
FAQ
What counts as a suspicious email? Urgency or threat, unexpected attachments or invoices, sender addresses that almost match a real one, requests for passwords or payment changes, links or QR codes you did not ask for. If in doubt, report.
Is the Report Phishing button in Outlook safe to use? Yes — it sends the email to Microsoft and your security team for analysis. It is the fastest way to get a malicious email blocked company-wide.
I entered my password on a fake login page. What now? Change that password immediately, then any account sharing it, report to IT, and tell them exactly what you entered. If it was a work account, IT will check for attacker-added forwarding rules and active sessions.