Report Phishing Email & Block Sender: Step-by-Step

Phishing emails are fraudulent messages designed to trick you into revealing personal information like passwords, credit card numbers, or login credentials. This guide shows you how to report a phishing email to your email provider and block the sender, reducing the risk of future attacks and helping protect others.

What You’ll Need

• Access to the email account that received the phishing message
• The phishing email still in your inbox or spam folder (do not delete it yet)
• About 2–3 minutes of your time

Step-by-Step

For Gmail (Web Browser)

1. Open Gmail in your web browser and log in if needed.
2. Click the checkbox next to the phishing email to select it. Do not open or click any links inside the email.
3. Click the three vertical dots (More) icon in the top toolbar.
4. Select Report phishing from the dropdown menu.
5. In the confirmation pop-up, click Report Phishing Message to confirm. Gmail will move the email to your spam folder and use the report to improve its filters.
6. To block the sender, click the three vertical dots next to the reply arrow in the open email (or right-click the email in the list).
7. Choose Block [sender name]. Future emails from this address will go directly to your spam folder.

For Outlook (Web/Desktop)

1. Open Outlook and select the phishing email by clicking on it.
2. In the top ribbon, click the Report button (a shield icon with a warning). If you don’t see it, click the three dots (More actions) and look for Report phishing.
3. Choose Phishing from the dropdown and click Report. Outlook will send a copy to Microsoft for analysis.
4. To block the sender, click the three dots (More actions) in the email toolbar.
5. Select Block and then Block sender. Confirm if prompted.

For Apple Mail (iPhone/iPad/Mac)

1. Open the Mail app and tap the phishing email to open it.
2. Tap the Report Junk icon (a small trash can with an X) at the bottom of the screen (iPhone/iPad) or click the Junk button in the toolbar (Mac). This marks it as junk but does not report it to Apple as phishing.
3. To report phishing to Apple, forward the email as an attachment to reportphishing@apple.com. To do this, tap the reply arrow, choose Forward, then long-press the email content and select Forward as attachment (or use the menu option on Mac).
4. To block the sender, tap the sender’s name/email at the top of the message, then tap Block this Contact (iPhone/iPad) or click the sender’s name and choose Block Contact (Mac).

For Yahoo Mail

1. Open Yahoo Mail and select the phishing email.
2. Click the Spam icon (a shield with an exclamation mark) in the toolbar. This marks it as spam.
3. To report phishing specifically, click the three dots (More) in the toolbar and select Report phishing.
4. To block the sender, click the three dots next to the sender’s name in the open email, then choose Block sender.

General Steps (Any Provider)

1. If your provider lacks a dedicated phishing button, forward the email to your provider’s abuse address (e.g., abuse@gmail.com, abuse@outlook.com) or to the Anti-Phishing Working Group at reportphishing@apwg.org.
2. After reporting, delete the email from your inbox and empty your trash folder to avoid accidental clicks later.

Common Mistakes

• Clicking links or downloading attachments before reporting – this can trigger malware or credential theft. Always report first, then delete.
• Blocking without reporting – blocking only affects your inbox; reporting helps the provider block it for everyone.
• Using the “Report Spam” button instead of “Report Phishing” – spam is just unwanted; phishing is malicious. Use the specific phishing option when available.
• Deleting the email before reporting – you need the email in your inbox to report it. If you deleted it, recover it from trash first.
• Replying to the sender – never reply, even to ask to be removed. This confirms your address is active and may lead to more attacks.

Tips

• Check the sender’s full email address, not just the display name. Phishing often uses a lookalike domain like “amaz0n.com” instead of “amazon.com”.
• Hover over any links (without clicking) to see the actual URL. If it doesn’t match the legitimate site, it’s phishing.
• Enable two-factor authentication on your email account. Even if your password is stolen, the attacker can’t get in without the second factor.
• Keep your email provider’s app and operating system updated to ensure you have the latest security patches.
• If the email appears to be from a company (bank, shipping service, etc.), report it directly to that company using their official contact page, not any link in the email.

Troubleshooting

• I can’t find the “Report phishing” option. Some providers only show it when the email is open. If you still can’t find it, use the “Report spam” option or forward the email to your provider’s abuse address.
• The email is already in my spam folder. You can still report it. Open the spam folder, select the email, and follow the same steps. If your provider doesn’t allow reporting from spam, move it to your inbox first, then report.
• I accidentally clicked a link in the phishing email. Immediately change your passwords for the affected accounts, enable two-factor authentication, and run a security scan on your device. Report the email afterward.
• The block option is greyed out or missing. This can happen with certain providers or when the email is in a shared mailbox. Use the provider’s web interface instead of the mobile app, or create a filter/rules to automatically delete emails from that sender.
• I reported the email but it’s still in my inbox. Reporting usually moves the email to spam or deletes it, but some providers take a few minutes. Manually delete it if it remains after an hour.

Frequently Asked Questions

What is phishing?

Phishing is a cyberattack where criminals send fraudulent emails that appear to be from legitimate sources to trick you into revealing sensitive data like passwords, credit card numbers, or social security numbers.

Will reporting a phishing email get me in trouble?

No. Reporting phishing is encouraged by all email providers. It helps them improve their filters and protect other users. You won’t be penalized for reporting a suspicious email.

Can I block a sender if I’m using the mobile app?

Yes, most mobile email apps (Gmail, Outlook, Apple Mail) have a block option in the message view. Look for the three-dot menu or the sender’s name to find it.

What if the phishing email is from someone I know?

If a friend or colleague’s account is compromised, they may send phishing emails. Report the email as phishing and contact the person through another channel (phone, text) to warn them their account may be hacked.

How long does it take for the provider to act on my report?

It varies. Some providers update filters within hours, others take days. Your report is added to a database used to improve spam detection. You may not see an immediate change, but your report contributes to long-term protection.

Should I report phishing emails to the company being impersonated?

Yes, if the email pretends to be from a specific company (like PayPal or Amazon), forward the email to that company’s official phishing-reporting address (e.g., spoof@paypal.com). This helps them take down fraudulent domains and warn other customers.

Related

• AI Agent Permissions: Check Before Connecting
• Keep AI Agents Running Reliably in the Cloud
• Nvidia Shield TV 4K HDR Setup Guide