How to report a phishing email, and why you should
2 min read · Updated October 15, 2026
Use your email provider’s ‘report phishing’ option, then delete the message. At work, forward it to your IT or security team. You can also report scams to your national cybercrime or consumer protection service, and to the company being impersonated.
Why reporting matters
Reports help providers block the sender and teach filters to catch similar messages. They also help the company being impersonated take down fake sites and warn customers.
Where to report
- ✓Your email provider: use the built-in report phishing or report spam option.
- ✓Your employer: forward to the designated security address, or use the report button in your email client.
- ✓The impersonated company: many publish a dedicated reporting address.
- ✓Your national cybercrime or consumer protection authority.
Got a suspicious email about a leak?
Scammers love leaked data. See whether your address is genuinely in a known breach so you know how much of the message is real.
What to include
Do not click anything. Where possible, report using the built-in option because it passes along the technical details automatically. If you forward a message manually, include the full original message.
If you already responded
Change affected passwords, contact your bank if payment details were shared and enable two-factor authentication. Then report the message anyway to help others.
Frequently asked questions
Will reporting get me in trouble?+
No. Reporting is encouraged, particularly in workplaces.
Should I reply to scammers to waste their time?+
No. Replying confirms your address is active and can invite more messages.
Does reporting remove the email from my inbox?+
Usually it moves it to spam. Delete it afterwards.
Stop guessing. Check your email in seconds.
The free Leakill check looks for your email address in known breach records and tells you whether it was exposed. If it was, an optional detailed report lists the incidents, dates, sources, the kinds of data involved and practical next steps. It is a one-off report, not a subscription.
A breach match is a warning signal, not proof that someone has access to your account today. No public database covers every breach, so a clean result lowers risk without guaranteeing safety.