In short: To report a phishing email at work, use your organisation's report button in Outlook or Gmail, or follow your IT team's process. In the UK you can also forward suspicious emails to report@phishing.gov.uk and scam texts to 7726. If money was lost or an account was hacked, report it to Report Fraud.
At work: use the report button first
If you receive a suspicious message on a work account, your organisation's process comes first, because your IT or security team can act on it for everyone.
- Do not click links, scan QR codes, open attachments or reply.
- Use the report button: in Outlook this is usually the built-in Report option or an add-in your organisation has installed; in Gmail it is Report phishing in the message menu.
- If there is no button, follow your IT team's instructions, typically forwarding the message as an attachment to a security mailbox.
- Report even if you are unsure. A false alarm costs nothing; a missed real attack can cost a great deal.
- Delete the message once it has been reported, unless IT asks you to keep it.
In Microsoft Teams, use More options and Report this message on a suspicious chat; our Microsoft Teams phishing awareness page explains how that works.
UK national reporting routes
Alongside your internal process, the UK has free national services for reporting scams. Many organisations let staff report directly; others prefer IT to forward reports on everyone's behalf, so check your own policy.
| What you received | Where to report it |
|---|---|
| A suspicious email | Forward it to the NCSC's Suspicious Email Reporting Service at report@phishing.gov.uk. There is no need to forward messages already in your spam or junk folder |
| A scam text message | Forward it to 7726, a free service supported by most UK mobile networks, so the sender can be investigated and blocked |
| A QR code in a message or on a poster | Take a screenshot or photo and email the image to report@phishing.gov.uk |
| A suspicious website | Use the NCSC's online form to report a scam website |
| You lost money or were hacked (England, Wales, Northern Ireland) | Report it to Report Fraud at reportfraud.police.uk, and contact your bank straight away using its official contact details |
| You lost money or were hacked (Scotland) | Report it to Police Scotland on 101 |
Report Fraud is the national fraud and cyber crime reporting service run by the City of London Police. It replaced Action Fraud from 4 December 2025, so update any staff guidance or posters that still mention the old name. The NCSC asks people not to report crimes through its own website forms.
If you have already clicked
Mistakes happen, and owning up quickly is what matters. Make sure staff know these steps, and that they will not be blamed:
- Tell IT immediately, and say exactly what happened: clicked a link, opened a file, entered a password or approved an MFA prompt.
- If you entered a password, change it from a device you trust, and change it anywhere else you used the same password.
- If you opened an attachment, follow IT's instructions, which may include disconnecting the device from the network.
- If you shared bank or payment details, contact your bank using the number on its website or card.
- Report the message through the report button so others can be protected too.
IT can then sign the account out of all sessions, check for new mailbox rules or MFA methods, and look for the same message in other inboxes.
Why a fast report matters
Phishing campaigns rarely target one person. When the first report arrives, your security team can search for the same message across every mailbox and remove it, block the sender and the malicious website, and reset any accounts that may be affected. The faster the first report, the smaller the window for the attacker.
That is why time to first report is one of the most useful measures in a phishing simulation programme, and why the NCSC encourages organisations to make reporting simple and to give people feedback on what happened to their report. Our page on measuring security awareness training explains how to track it.
Setting up reporting for your organisation
For IT and security teams, a good reporting set-up includes:
- One report button for every user on desktop, web and mobile, rather than a mix of methods
- A reporting mailbox monitored by someone, with reports also sent to your email security vendor where supported
- Teams reporting switched on: in Microsoft Defender for Office 365 Plan 1 or Plan 2, users can report suspicious Teams messages, calls and meetings
- Feedback to the reporter, even a short automated thank-you, so people keep reporting
- Simulation integration, so reports of simulated phishing are recorded as successes in your awareness platform
Most security awareness training software includes a report button that does all of this, and many email security products, such as Check Point Harmony Email and Collaboration, use user reports to improve detection.
How we help
We set up the report button, the reporting mailbox and Teams reporting, write a one-page staff guide to reporting with the correct UK routes, and measure report rates through regular simulations. When reports come in, our security team can help triage them.
Contact us to get phishing reporting working properly.
How Forever Systems runs your awareness programme
We are vendor-independent. We compare the security awareness and phishing simulation platforms that suit your size, sector, Microsoft 365 licensing and existing security tools, recommend one, then run it for you so training and phishing tests actually happen month after month.
- Baseline phishing simulation to see where you start
- Platform selection and set-up, with single sign-on and automatic user sync from Microsoft Entra ID or Google Workspace where the platform supports it
- A year-round plan of short training modules, simulated phishing campaigns and policy sign-off, including new-starter induction
- Sector and role content for schools, charities, healthcare, legal, finance, public sector and high-risk roles such as finance teams and help desks
- Reporting for the board, auditors, insurers and Cyber Essentials, showing completion, reporting and click trends
- Joined-up defences: email security, MFA, endpoint protection and dark web monitoring so training is backed by technology
Forever Systems Ltd provides IT and cyber security services to UK organisations. Pricing depends on user numbers and platform, so ask us for a quote.
Want help choosing and running security awareness training?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What happens when I forward an email to report@phishing.gov.uk?
The NCSC's Suspicious Email Reporting Service analyses the message and the links in it, and can act against malicious websites it finds. You will not usually get an individual reply. It does not replace reporting a crime: if you have lost money, also report it to Report Fraud.
Should I report work phishing emails to the NCSC myself?
Follow your organisation's process first, because your IT team can protect your colleagues. Some organisations then forward reports to the NCSC on everyone's behalf; others are happy for staff to do it directly.
Is Action Fraud still the place to report fraud?
No. From 4 December 2025, fraud and cyber crime in England, Wales and Northern Ireland is reported to Report Fraud at reportfraud.police.uk, which replaced Action Fraud. In Scotland, report to Police Scotland on 101.
How do I report a scam text message?
Forward the text to 7726. It is free and most UK mobile networks take part. If the text included a QR code, you can also email a screenshot to report@phishing.gov.uk.
How do I report a phishing message in Microsoft Teams?
Hover over the message, select More options, then Report this message, and choose the security risk option. Your organisation needs Teams reporting switched on, which is available with Microsoft Defender for Office 365.