How to report phishing

Where to report phishing emails, texts and calls: at work first, then to the right national authority.

Reporting a phishing message takes seconds and can stop the same attack reaching other people. Here's where to send it.

At work: report it to your security team first

• Use your report button. If your organisation uses PhishFoil, click Report phish in Outlook or the browser extension. It sends the message to your security team and removes it from your inbox.
• No button? Forward the email as an attachment to your IT or security team, or call them.
• Clicked a link or entered a password? Tell IT straight away and change the password. Speed matters more than embarrassment.

In India

• National Cyber Crime Reporting Portal: report online at cybercrime.gov.in.
• Financial fraud helpline: call 1930 as soon as possible if you've lost money.
• Organisations: report cyber security incidents to CERT-In at incident@cert-in.org.in.

In the United States

• Federal Trade Commission: ReportFraud.ftc.gov.
• FBI Internet Crime Complaint Center: ic3.gov, especially if money was lost.
• Anti-Phishing Working Group: forward phishing emails to reportphishing@apwg.org.

In the United Kingdom

• Suspicious emails: forward them to report@phishing.gov.uk (National Cyber Security Centre).
• Suspicious texts: forward them to 7726 (free on most networks).

Text and phone scams everywhere

• Don't reply, call back, or tap links in unexpected messages.
• Contact the company directly using a number or app you already trust.
• Block the number once you've reported it.

Practise spotting the next one

Try the Phishing IQ Test or the Spot the Red Flags game to sharpen your instincts.