How to report a scam email

The 10-step phishing-email reporting checklist

1. 1

   Don't click, don't reply, don't unsubscribe

   Even the unsubscribe link confirms your address is live. Just leave the message in your inbox while you collect evidence.

2. 2

   Capture the full headers

   Gmail: ⋮ menu → 'Show original'. Outlook: File → Properties → 'Internet headers'. Apple Mail: View → Message → All Headers. Copy them into a text file — they reveal the real sending server and let abuse teams act fast.

3. 3

   Report inside your email client

   Gmail: ⋮ → 'Report phishing'. Outlook: 'Report' → 'Phishing'. iCloud: forward to reportphishing@apple.com. Provider-level reports kill the campaign at the source — mass reports trigger account suspension within hours.

4. 4

   Report to GACS

   Submit at /report. The sender domain / address is added to the public scam database within minutes so the website checker flags any linked URL.

5. 5

   Report to APWG

   Forward (with full headers) to reportphishing@apwg.org. APWG feeds the data into Microsoft SmartScreen, Google Safe Browsing, and browser block lists worldwide.

6. 6

   Report to the FTC

   File at reportfraud.ftc.gov. Pick 'Email scam'. Paste the headers and the email body. The FTC's Consumer Sentinel Network shares it with 3,000+ partner agencies.

7. 7

   Report to the impersonated brand

   PayPal: spoof@paypal.com. Amazon: stop-spoofing@amazon.com. Microsoft: report through Outlook 'Report' menu. IRS: phishing@irs.gov. Most major brands have a published abuse address — search '[brand] report phishing email'.

8. 8

   Report the linked domain

   If the email contains a fraudulent URL, run it through the GACS website checker, then file separately with Google Safe Browsing (safebrowsing.google.com/safebrowsing/report_phish) — that triggers the browser warning Chrome / Safari / Firefox users will see.

9. 9

   Report to your email provider's abuse contact

   If the sender address looks legitimate but content is malicious (compromised account, internal forwarding rule), email abuse@<their-domain>. Many corporate IT teams act within hours on documented abuse reports.

10. 10

    If you clicked or entered credentials

    Change the password on the impersonated account immediately, enable MFA, and check the 'Recent activity' / 'Sessions' page for foreign logins. If you entered card or banking details, call your bank now — same-day reports unlock chargebacks and wire recall.

Free copy-paste reporting templates

Reports written in plain English with concrete evidence get actioned faster than walls of text. Copy a template, swap in the details, and paste.

Subject: Phishing email — [impersonated brand]

Hello APWG,

Forwarding a phishing email that impersonates [brand] and points to [URL]. Full headers below. Domain was registered on [date] per WHOIS, uses a free SSL certificate, and the page collects [credentials / card / seed phrase].

[Paste full headers + original email body here]

Thanks,
[Your name or anonymous]

Subject: Spoofing report — phishing email impersonating [brand]

Hello,

Reporting a phishing email impersonating [brand]. The message asks recipients to [verify account / confirm payment / claim refund] and links to [URL]. Domain is not affiliated with [brand]. Full headers and message below.

[Paste full headers + body]

Please take action under your acceptable-use / brand-protection process.

FAQ