How to Spot and Report Phishing Emails, Texts, and Websites
Learn to recognize phishing, verify messages safely, report them, and respond if you clicked or shared information.
Prerequisites
A way to contact the organization through a channel you already trust, such as its official app, a saved bookmark, or a phone number on a payment card or statement.
Access to the email, messaging, or browser service where you received the suspicious message, so you can use its reporting tools.
If the message concerns work or school, know how to contact your IT or security team.
How to spot phishing
Phishing is a message or website that impersonates a person or organization to get you to reveal information, pay money, or open a harmful link or file. It can arrive by email, text, social media message, or other electronic communication.
Watch for unexpected requests, pressure to act immediately, threats or prizes, requests for passwords or financial details, and links or attachments you were not expecting. Check the sender’s full email address or phone details, but remember that a familiar name or number alone does not prove a message is genuine. Look for a web address that does not match the organization’s real domain, misspellings, or a sign-in page asking for unusual information. These clues can help, but no single clue proves a message is fake or safe.
Steps to verify and report a suspicious message
Pause. Don’t reply, click a link, open an unexpected attachment, or provide personal or payment information. Don’t follow a message’s instructions to install software or change security settings.
Verify independently. Open a new browser tab and go to the organization’s site using a saved bookmark or an address you type yourself. Or contact it using details from a trusted source, not the suspicious message. If a message appears to come from someone you know, check with them through a separate channel.
Report the message. Use your email or messaging service’s built-in report or phishing option, if available. For Outlook, Microsoft provides steps for reporting suspicious messages in its phishing protection guidance. For unwanted emails and texts, consult the FTC’s consumer guidance for reporting advice. If it involves a work or school account, notify your IT or security team as well.
Report a suspicious website. Don’t enter information on it. Use the browser’s report-unsafe-site feature if available. Microsoft describes reporting a suspicious site in its online safety guidance; the instructions there include a Microsoft Edge option.
Delete or block after reporting. Keep the message only if your organization or service provider asks you to preserve it for investigation. Don’t forward suspicious content to other people as a warning; share the warning without its links or attachments.
If you already clicked or shared information
If you entered a password, go directly to the real service using a trusted route and change that password. If you reused it elsewhere, update those accounts too. Turn on two-factor authentication where available; see how to enable two-factor authentication.
If you shared payment or bank details, contact your bank or card issuer promptly using a trusted number or app, and tell them what happened. For a work or school device or account, contact IT immediately.
If you opened an attachment or installed something, stop interacting with the message and contact your organization’s IT support if applicable. Use security guidance from your device or software provider for steps specific to your device; don’t rely on a pop-up or phone number shown by the suspicious page.
Troubleshooting
The message looks real, but I’m unsure. Don’t use its link. Verify with the organization through a separate, trusted channel. A polished design or correct-looking logo is not proof.
I can’t find a report button. Check the service’s help pages or contact its support through the app or official website you navigate to yourself. Reporting options vary by service.
I already reported it but still receive similar messages. Continue reporting new messages through the service, and avoid replying or clicking. If money, account access, or a work system may be affected, contact the relevant provider or security team directly.
