To report a phishing email, forward it as an attachment to your email provider’s phishing-report tool, to the Anti-Phishing Working Group at reportphishing@apwg.org, and to the Federal Trade Commission at ReportFraud.ftc.gov, then notify the company the message impersonated. Knowing how to report a phishing email properly takes about five minutes, and doing it in more than one place matters because each recipient uses the information differently: your provider updates spam filters, the APWG feeds an industry threat database, and federal agencies aggregate complaints to build cases.
Gather the Evidence First
A useful report includes more than the message body. The most valuable piece of evidence is the full email header, which contains routing data, server names, and the sender’s actual IP address. In Gmail, open the message, click the three-dot menu next to the reply button, and select “Show original.” In Outlook, open the message and look for “View message source” or the message properties dialog. Copy the entire header into a plain text file so the formatting survives.
Also save the sender’s full email address as it appears in the header (not just the display name), the exact subject line, and any URLs in the message. To capture a link safely, right-click and copy the URL without visiting the page. Note what personal information the email asked for, but do not include your own sensitive data in what you send. Redact Social Security numbers, account numbers, and passwords from any screenshots.
One detail trips people up. When you send the email to a reporting address, use Forward as Attachment, not a regular forward. A standard forward strips out the header data investigators need. In Gmail, check the message’s box, click “More” at the top of the screen, and choose “Forward as attachment.”1Google Help. Download and Send Emails as Attachments – Gmail Help On a Mac using Apple Mail, select the message and choose “Forward As Attachment” from the Message menu.2Apple Support. Identify Legitimate Emails From the App Store or iTunes Store
Report Through Your Email Provider
Your email provider is the fastest channel because the data goes straight into the filters that protect every user on that platform. When you flag a message, the provider analyzes the sender’s domain, IP reputation, and content, then updates spam rules across its network.
- Gmail: Open the message, click the three-dot menu next to the reply button, and select “Report phishing.” Google reviews it against known malicious signatures and may block the sender across all Gmail accounts.3Google Help. Avoid and Report Phishing Emails – Gmail Help
- Outlook: Select the message, click the “Report” button above the reading pane, and choose “Report phishing.” This alerts Microsoft but does not automatically block the sender from emailing you again; add them to your blocked senders list separately.4Microsoft Support. Phishing and Suspicious Behavior in Outlook
- Yahoo Mail: Select the message and click “Spam” to move it and flag it for Yahoo’s filters. If Yahoo displays a suspicious-message alert banner at the top of the email, click “Report” there instead. Yahoo does not offer a separate phishing-report option distinct from spam.5Yahoo Help. Protect Yourself From Phishing
- Apple iCloud Mail: If the email impersonates Apple or references an App Store or iTunes purchase, forward it as an attachment to reportphishing@apple.com.2Apple Support. Identify Legitimate Emails From the App Store or iTunes Store
Provider-level reporting only protects users on that one platform. The next steps reach further.
Forward to the Anti-Phishing Working Group
The Anti-Phishing Working Group is a global coalition of security companies, financial institutions, and law enforcement agencies that maintains one of the largest phishing databases in the world. Forward the suspicious email as an attachment to reportphishing@apwg.org.6APWG. Report Phishing Emails Here to Warn the World The APWG archives the message and shares indicators like sender domains, URLs, and IP addresses through its eCrime eXchange, where member organizations use the data to block fraudulent sites and take down phishing infrastructure.
The FTC itself points people to this address as the primary way to share the raw message content with researchers.7Federal Trade Commission. How To Recognize and Avoid Phishing Scams The “Forward as Attachment” step matters here more than anywhere else, because APWG’s automated systems pull technical details from the full header that a plain forward would lose.
File a Report With the FTC
The Federal Trade Commission collects phishing reports through ReportFraud.ftc.gov.8Federal Trade Commission. ReportFraud.ftc.gov The form walks you through screens where you describe what happened, identify the type of contact, and enter details about the sender: the fraudulent URL, the email address, and a written description of the scam. The FTC shares this data with thousands of law enforcement partners at the federal, state, and local level.
A report to the FTC will not usually generate a call back about your specific email. The agency uses aggregate complaint data to identify large-scale fraud campaigns, prioritize enforcement, and issue consumer warnings. When many people report the same sender domain or template, the pattern becomes visible in ways a single report cannot.
Report to CISA and the FBI
Two federal agencies accept phishing reports, and each uses the information for a different purpose.
CISA
The Cybersecurity and Infrastructure Security Agency focuses on the technical threat. Submit reports through its portal at cisa.gov/report.9CISA. Reporting a Cyber Incident CISA also historically accepted phishing emails forwarded to phishing-report@us-cert.gov.10CISA. Reporting a CyberCrime Complaint Tip Card These reports feed national monitoring systems that track which phishing campaigns are spreading and which infrastructure supports them.
FBI Internet Crime Complaint Center
If the phishing email caused financial loss or led to an account takeover, file a complaint with the FBI’s Internet Crime Complaint Center at ic3.gov. The IC3 form asks for your contact information, details about the subject (name, email, IP address if you have it), a description of the incident, and any transaction information. Keep your original evidence, because the IC3 does not accept file attachments through its portal; if an investigation opens, the assigned agency may request the full headers, chat logs, and network data from you directly.11Internet Crime Complaint Center (IC3). Frequently Asked Questions
Neither CISA nor the IC3 typically contacts you about an individual complaint. Filings are analyzed in bulk and may be referred to federal, state, local, or international law enforcement.12Internet Crime Complaint Center (IC3). Complaint Form
Tell the Company Being Impersonated
If the email pretends to be from a bank, retailer, or other recognizable brand, report it to that company’s security team. Most large organizations publish a dedicated address for this, often abuse@, spoof@, or phishing@ followed by the company domain. Searching the company name plus “report phishing” will usually surface the correct address. Forward the message as an attachment so the company receives full header information along with the body.
Brand protection teams use these reports to send takedown requests to the domain registrars and hosting providers behind the fake site. They also warn other customers through security bulletins. You will usually get an automated confirmation, sometimes with account-security advice. This step is especially worth doing for financial institutions, which have both the legal resources and the direct motivation to shut down impersonation domains quickly.
What About Phishing Texts and Calls?
Phishing is not limited to email, and the reporting channels differ.
For suspicious text messages, forward the message to 7726 (which spells “SPAM” on the keypad). This short code works across major U.S. wireless carriers.13AT&T. Report Unwanted Text Messages Your carrier will reply asking for the phone number the text came from. You can also report the text to the FTC at ReportFraud.ftc.gov.
For fraudulent phone calls, especially those using spoofed caller ID to impersonate a government agency or bank, file a complaint with the FCC at consumercomplaints.fcc.gov.14FCC Complaints. Filing a Complaint Questions and Answers Choose the “Phone” category and describe the issue. You will not receive status updates on these complaints.
If You Clicked a Link or Entered Information
Reporting the email is separate from protecting yourself. If you actually clicked a link, entered a password, or handed over financial details, reporting is not enough. Move fast, because the window between credential theft and account takeover can be hours.
- Change your passwords immediately, starting with the compromised account and any other account that uses the same credentials. Turn on two-factor authentication wherever it is available.
- Call the fraud department of any bank, credit card issuer, or service where your information was exposed. Ask them to freeze or close the affected accounts so no new transactions go through without your approval.15Federal Trade Commission: IdentityTheft.gov. Identity Theft Steps
- Place a free one-year fraud alert by contacting any one of the three major credit bureaus (Equifax, Experian, or TransUnion). That bureau is required to notify the other two.15Federal Trade Commission: IdentityTheft.gov. Identity Theft Steps
- Consider a credit freeze. It restricts access to your credit report and blocks new accounts from being opened in your name. It is free to place and lift and lasts until you remove it. Unlike a fraud alert, you have to contact each of the three bureaus separately.16Consumer Advice – FTC. Credit Freezes and Fraud Alerts
- Pull free reports from all three bureaus at annualcreditreport.com and look for accounts or inquiries you do not recognize.
- If personal information was exposed, go to IdentityTheft.gov to create an official Identity Theft Report and a personalized recovery plan. That report can help you dispute fraudulent accounts and remove bogus charges from your credit file.15Federal Trade Commission: IdentityTheft.gov. Identity Theft Steps
The difference between someone who recovers quickly from a phishing attack and someone who spends months untangling fraud usually comes down to how fast they locked things down. Reporting the email is step one. Securing your accounts is what actually protects your money.