How to report a phishing email in Gmail and Google Workspace

KEY TAKEAWAYS

In Gmail on a computer: open the email, click the three-dot menu, choose "Report phishing".
That report goes to Google. Tell your own IT person too, so they can warn colleagues.
In the UK, also forward it to report@phishing.gov.uk.
A quick report protects everyone who got the same email, which is why it matters even more than not clicking.

How to report a phishing email in Gmail

If your business uses Google Workspace, your work email is Gmail, and Gmail has a built-in way to report phishing. These steps are for anyone on the team. Google does change its menus from time to time, so the exact wording may differ slightly.

1. Don't click anything in the email

Leave links, buttons and attachments alone. You can open the email to read it, but don't reply, and don't forward it to colleagues to ask "is this real?". That spreads the link further.

2. Open the three-dot menu

On a computer, open the email. At the top right of the message, next to the Reply arrow, click the three vertical dots (the "More" menu).

3. Choose "Report phishing"

Click Report phishing and confirm if asked. That's it. In the Gmail app on a phone, the options in the menu can vary between devices and versions. If you can't see "Report phishing" there, report it from a computer when you can, or tell your IT person straight away.

Workspace Admin <no-reply@workspace-alerts.co> · Action needed: verify your account by 5pm

Hi Ellie, we couldn't confirm your account during a routine security check. Please verify your details using the button below to keep access to your email and files.

One to report, not delete: a sender that isn't Google or your company, a vague "security check" and a same-day deadline.

4. Tell your own team

"Report phishing" sends the report to Google, which uses reports like this to improve its filtering. It isn't the same as telling your business. Let whoever handles IT know, or post a short heads-up in your team chat: what the email was about and who it claimed to be from. Don't paste the link.

Lureproof's report-phish button, which will let staff report a suspicious email in one click and count reports of practice emails too, is coming soon. Until then, the steps above are the way to do it.

For Google Workspace admins: what happens to reports

If you're the person who looks after Google Workspace, it helps to know what a staff report does and where you can follow it up. Google's Admin console is at admin.google.com. Menu names can change, and some tools are only in certain Workspace editions, so treat these as pointers rather than exact paths.

Reports go to Google first. When someone clicks "Report phishing", Google receives a copy of the message to help improve detection across Gmail.
The security area of the Admin console. Look under Security for the alert centre and the security dashboard. Depending on your edition, these can show alerts or charts based on user reports of phishing and spam.
Searching for the same email. Admin tools such as email log search (and, in higher editions, the security investigation tool) can help you check whether the message reached other people, and in some editions remove it from their inboxes.
Not sure what your plan includes? Search Google's Workspace Admin Help for "user reports" and your edition. It's worth ten minutes before you need it.

Whatever your edition, the simplest fix for a small team is cultural rather than technical: make sure people tell you directly, as well as clicking the button.

Reporting to the UK's NCSC

In the UK, the National Cyber Security Centre runs the Suspicious Email Reporting Service. Forward the suspicious email to report@phishing.gov.uk. The NCSC analyses what it receives and can act against scam websites, which helps protect people well beyond your business. Scam texts can be forwarded to 7726.

Forwarding to the NCSC is free and works from any email account. It's a good habit alongside Gmail's button, not instead of telling your own team. If someone has already clicked, entered details or paid, follow our clicked a phishing link checklist first.

Would your team spot it to report it?Six real-looking emails. Two minutes. No sign-up.

Take the test →

Why reporting matters more than not clicking

Most security advice is about not clicking. That matters, but it's only half the story. Phishing rarely arrives for one person. The same email often lands in several inboxes at once, and it only takes one click.

One report protects everyone. The first person who spots it can warn the rest of the team before anyone else clicks.
Fast reports limit the damage. If someone has already clicked, an early heads-up gives you time to change passwords and check accounts.
Reports help beyond your business. Reports to Google and the NCSC feed filters and takedowns that protect other people too.
It's a better measure. A team that clicked a practice email but reported it quickly is in better shape than a team that stayed silent.

People only report if it feels safe. Thank everyone who does, even when it turns out to be a real newsletter, and never make someone feel foolish for clicking. That's the thinking behind Lureproof: practice emails that end in a 60-second lesson, not a telling-off. Our free security training covers the rest.

FAQ

How do I report a phishing email in Gmail?

On a computer, open the email, click the three-dot menu next to Reply at the top of the message, and choose Report phishing. Then tell whoever handles IT for your business so they can warn colleagues.

Does "Report phishing" tell my IT admin?

Not in the way a message would. The report goes to Google. Depending on your Google Workspace edition, admins may see user reports in the security area of the Admin console, but it's safest to tell your IT person directly as well.

Where do I forward phishing emails in the UK?

Forward them to the National Cyber Security Centre's Suspicious Email Reporting Service at report@phishing.gov.uk. Scam texts can be forwarded to 7726.