Use Gmail’s report option safely
To report phishing in Gmail, open the message without clicking links or attachments, choose the three-dot More menu, and select Report phishing. On mobile, use the message options menu and choose the same report option when available. Then delete the email, block repeat senders, and report financial losses separately.
Reporting tells Gmail that the message is pretending to be someone trustworthy. It is different from marking ordinary spam, because phishing is about deception: fake invoices, fake account warnings, fake delivery notices, fake bank alerts, or fake requests from a boss, relative, vendor, or service you use.
Check the message before reporting
Slow down for ten seconds. Do not click the link to “verify,” do not download the attachment, and do not reply to ask if the message is real. If the email claims to be from a company, open a new browser tab and go to that company’s site yourself.
Check the sender address by expanding the details. A display name can say “Google Security” while the actual address is a random domain. Look for mismatched reply-to fields, urgent threats, odd grammar, password reset links you did not request, and attachments that pretend to be invoices or shared documents.
If you need to identify a person behind a suspicious message, use only information you already have. A name, phone number, or business claim can sometimes be checked through a people search or a reverse phone lookup, but never paste private account codes or sensitive email content into a tool.
Report the email from Gmail on desktop
- Open Gmail in your browser and select the suspicious email.
- Do not follow any link inside the message.
- Click the three-dot More menu near the reply controls.
- Choose Report phishing.
- Confirm the report if Gmail asks.
- Delete the message after the report is submitted.
If you cannot find the phishing option, use Report spam as a fallback and then delete the message. Reporting is still useful because it feeds Gmail’s filtering systems and reduces the chance that similar messages keep landing in your inbox.
Use the Gmail app report option
The mobile flow is similar, but the menu can be easier to miss. Open the message, tap the options menu for that email, and look for Report phishing. If your version of the Gmail app only shows Report spam, use that option and avoid interacting with the message afterward.
On a phone, the biggest risk is accidental tapping. Do not press links to “preview” them. Do not open attachments just to see whether they look legitimate. If the message says a package, payment, or account will be canceled today, treat that urgency as part of the test.
Take recovery steps outside Gmail
Gmail reporting helps with filtering, but it does not recover money, secure accounts, or alert every agency that may need the information. If you sent money, shared a password, gave a verification code, opened a malware attachment, or entered personal information on a fake page, take a second set of actions.
| What happened | Next step | Why it matters |
|---|---|---|
| You clicked but did not type anything | Close the page, clear the tab, and watch the account. | The link may have logged your visit or led to a fake form. |
| You entered a password | Change it from the real site and enable two-factor authentication. | The attacker may try the password immediately. |
| You sent money or gift cards | Contact the payment company and file fraud reports. | Speed can affect whether a transfer can be stopped. |
| You opened an attachment | Run security scans and avoid entering new passwords on that device. | Attachments can install malware or steal sessions. |
The FTC’s consumer scam guidance explains common scam categories and recovery steps. For internet-enabled fraud, the FBI Internet Crime Complaint Center is the federal reporting path. You can also report suspicious business offers through BBB Scam Tracker.
Verify unknown senders through a separate channel
Not every unknown sender is a criminal. Recruiters, contractors, schools, doctors, landlords, and local organizations may email from addresses you do not recognize. The difference is whether the message asks you to trust a link, send sensitive information, or act before you can verify the claim.
A safe workflow is simple: inspect the sender, read without clicking, verify through a separate channel, then decide whether to reply, report, block, or delete. If the message claims to come from someone you know, contact that person through a number or address you already trust.
For ongoing inbox safety, read the related guide on how to avoid phishing emails. The goal is not to be suspicious of every message. It is to make sure urgent emails do not push you into risky actions.
Avoid risky follow-up actions
- Do not reply with “stop emailing me.” That confirms your address is active.
- Do not use an unsubscribe link in a message that looks fraudulent.
- Do not forward the email to friends as a warning unless you remove dangerous links or send screenshots.
- Do not keep the message in your inbox if you know it is fake.
- Do not assume blocking one sender stops the campaign; attackers rotate addresses.
If the message used your real name, workplace, recent purchase, or a familiar company, that does not prove it is legitimate. Data from breaches, public pages, social media, and old forms can make a fake email feel personal.
For work accounts, follow your employer’s reporting process too. Many companies have a security mailbox, help desk queue, or built-in report button that alerts the internal team. Do not forward suspicious attachments unless the policy asks for that format; screenshots or the original message headers may be safer.
Frequently Asked Questions
How do you report phishing in Gmail?
Open the suspicious email, avoid its links and attachments, click the three-dot More menu, and choose Report phishing. Confirm the report if Gmail asks. After that, delete the message. If you already interacted with it, change affected passwords and report any money loss through the proper fraud channels.
How do you report phishing in Gmail on a phone?
In the Gmail app, open the suspicious message carefully, tap the message options menu, and look for Report phishing. If that option is not visible, use Report spam, delete the email, and avoid tapping anything inside it. Handle account recovery or payment issues outside Gmail.
What counts as phishing in Gmail?
Use Gmail’s phishing report option when the email impersonates a company, person, government office, payment service, or account alert. Spam is usually unwanted marketing or bulk junk. Phishing is a deceptive attempt to steal credentials, money, account access, or personal information.
