How to Report a Phishing Email: Where to Send It

Phishing emails are the most-reported internet crime in the country. In its 2025 annual report, the FBI’s Internet Crime Complaint Center (IC3) listed phishing and spoofing as the top crime type by number of complaints — 191,561 reports. Each email you report helps filters catch the next one.

Here is where to send a phishing email, in order, and what to do if you already clicked.

EXAMPLE — SCAM

Today 8:03 AM●●● ▮

From: Account Services <billing@account-update.example.com>

Subject: Action required: your payment method was declined

Hello Customer,

We were unable to process your latest payment and your account will be placed on hold. To avoid interruption, please update your billing information within 24 hours: https://account-update.example.com/billing

Thank you for being a valued member.

Before you report: do not click anything

CISA, the federal cybersecurity agency, puts it simply: resist the temptation to click links or attachments, and do not reply — not even to “unsubscribe.” Report the message using the steps below, then delete it.

Step 1: Use your email’s report button

Most email services have a built-in way to report phishing. CISA notes you will typically find it near the sender’s name or in the toolbar.

Gmail (on a computer): open the message, click More next to Reply, then click Report phishing.

Outlook.com: select the message in your message list, then above the reading pane select Report, then Report phishing. Microsoft notes that reporting a message does not block the sender — add the sender to your blocked senders list to stop future messages.

iCloud Mail (icloud.com, me.com, mac.com): Apple says to mark spam as Junk or move it to your Junk folder.

Other email services: look for “Report spam,” “Report phishing” or “Junk” in the message menu.

Step 2: Forward it to the Anti-Phishing Working Group

The FTC recommends forwarding phishing emails to the Anti-Phishing Working Group at reportphishing@apwg.org. The APWG is an industry group that collects phishing reports.

If the email pretends to be from a specific company, check that company’s official website for its own reporting address. For example, Apple asks people to forward emails that pretend to be from Apple to reportphishing@apple.com.

Step 3: Report it to the FTC

File a report at ReportFraud.ftc.gov. Choose the category that fits (for example, an impersonator), or “Something Else” if nothing fits. The FTC’s instructions:

• Paste the text of the email into the Comments field. The FTC cannot accept forwarded emails.
• Do not click any links in the email while you copy it.
• You can report even if you did not lose money.

Your report goes into the FTC’s Consumer Sentinel database, which is available to federal, state and local law enforcement. The FTC uses reports to investigate and bring cases, although it cannot resolve individual reports.

Step 4: Report to the FBI if you lost money

If the email led to financial loss, a hacked account or other online fraud, also file a complaint with the FBI’s Internet Crime Complaint Center at IC3.gov. Include the sender’s address, any websites or phone numbers in the email, and details of any payments.

Quick reference: where to report a phishing email

Situation	Report to
Any phishing email	Your email’s Report phishing button, reportphishing@apwg.org, and ReportFraud.ftc.gov
Email pretends to be a specific company	That company’s reporting address from its official website (for Apple: reportphishing@apple.com)
You lost money or an account was taken over	IC3.gov, plus your bank or card company right away
You shared your Social Security number	IdentityTheft.gov for a recovery plan
A phishing text instead of an email	Forward to 7726 — see how to report a scam text
A fake website	See how to report a scam or phishing website

If you clicked the link or replied

The FTC’s advice depends on what happened:

• You clicked a link or opened an attachment: update your security software, run a scan and remove anything it flags.
• You entered a password: change it now — and anywhere else you used the same password — and turn on two-step verification.
• You entered card, bank or Social Security information: contact your bank or card company using the number on the back of your card, and go to IdentityTheft.gov for steps based on what was exposed.

Our first-hour checklist covers each step in detail.

Learn to spot the next one

Phishing emails often look like they come from a bank, a card company, a utility or an online payment service, and claim suspicious activity, a payment problem or an invoice you do not recognize. See phishing emails: real examples and 7 red flags and what is phishing? for more.