Reporting phishing quickly can help protect your account, organization, and other potential targets. This guide explains where to report suspicious emails, text messages, websites, and workplace incidents, how to preserve useful evidence without interacting with the scam, and how to use a reusable incident report template.
Overview
A phishing report is most useful when it reaches the right recipient with enough context to support investigation. The correct destination depends on what happened: a fake bank message should be reported to the impersonated institution, a malicious domain to its hosting or domain provider, and a workplace message to your security or IT team. A report to a general inbox may still be worthwhile, but it should not replace urgent action on an account or payment.
Before reporting, do not click links, open unexpected attachments, reply, call a number supplied in the message, or scan a suspicious QR code. If you already interacted with the message, stop further activity and follow your organization’s incident process. For a broader pre-click review, see how to investigate a suspicious email, text, or website before you click.
Use this order of operations:
- Contain the risk: stop interacting with the message and disconnect or escalate if a device appears compromised.
- Preserve evidence: save the original message and relevant technical details without modifying them.
- Report to the affected organization: use contact details found independently through its official website, app, or statement.
- Report the infrastructure or account: notify the email provider, mobile carrier, social platform, registrar, hosting provider, or marketplace when applicable.
- Escalate loss or identity risk: contact your bank, payment provider, employer, or appropriate local reporting channel.
Checklist by scenario
| Scenario | Primary report destination | Include |
|---|---|---|
| Suspicious email | Your email provider and the organization being impersonated; your workplace security team if work-related | Original message, sender details, received time, subject, links, attachment names, and whether anyone clicked |
| Scam text message | Your mobile carrier, the impersonated organization, and your employer if it reached a company device | Screenshot, sender number or short code, full message text, link destination, and any reply or call |
| Malicious website | The impersonated brand, browser or security provider, domain registrar or hosting provider when identifiable | Exact URL, screenshots, redirect sequence, page behavior, and date and time observed |
| Social media or marketplace impersonation | The platform’s in-product reporting channel and the legitimate person or business | Profile URL, account name, copied branding, messages, payment request, and transaction details |
| Workplace phishing | Your internal security, IT, help desk, or incident-response channel | Original email or message, headers if available, affected account, device, actions taken, and exact times |
Use an independently verified route. Do not use a phone number, email address, or “support” link supplied by the suspicious message. Type the known domain yourself, use an official mobile application, or consult a trusted internal directory. For bank-related messages, the bank impersonation scam verification checklist provides a separate verification workflow.
Email reporting checklist
- Keep the original email in your mailbox if your security team may need it.
- Use the provider’s phishing-report function when available, rather than only deleting the message.
- Export or forward the message as an attachment if your organization requests original headers.
- Record whether the message was delivered to one person, a shared mailbox, or a larger group.
Text-message and QR-code checklist
- Capture the message and sender information before deleting it.
- Do not tap the link or scan the code to “check” where it goes.
- Describe the requested action: delivery fee, account verification, payment, login, or identity confirmation.
- If a QR code was displayed elsewhere, record where it appeared and photograph it only from a safe distance if needed.
Website checklist
- Copy the complete address without revisiting the page.
- Note the brand being impersonated and the information requested.
- Save a screenshot only if doing so is safe and does not expose credentials or personal data.
- Report the domain through the relevant provider’s abuse or security process when you can identify it reliably.
What to double-check
A strong phishing report separates what you observed from what you believe. Label assumptions clearly. For example, write “the link redirected to a login page” rather than “the domain is definitely controlled by the attacker.” A domain can be suspicious without proving who operates it. The guide to investigating a suspicious domain and spotting an impersonation website can help with that distinction.
Before submitting, check the following:
- Accuracy: Is the URL copied exactly, including the path and unusual characters?
- Timeline: Did you record when the message arrived, when it was opened, and when any action occurred?
- Scope: Did anyone else receive it, click it, enter credentials, or send money?
- Evidence integrity: Did you preserve the original instead of relying only on a cropped screenshot?
- Privacy: Did you remove unnecessary passwords, payment details, identity numbers, or unrelated customer data?
- Destination: Are you using a verified reporting channel rather than a contact address from the message?
If credentials were entered, change them from a known-safe device and invalidate active sessions where possible. If payment information or funds were involved, contact the financial provider through an independently verified channel. If personal information was exposed, use the data breach response checklist to organize follow-up actions.
Copyable phishing report template
Subject: Phishing report — [email, SMS, website, or account]
Date and time observed: [include time zone if known]
How received: [email, text, website, social platform, QR code]
Sender or account: [address, phone number, username, or profile URL]
Impersonated organization: [name, if applicable]
Exact URL or destination: [paste without visiting again]
Message summary: [what it claimed and what it requested]
Evidence attached: [original message, headers, screenshots, URL, file name]
Actions taken: [ignored, clicked, replied, called, entered data, paid]
Accounts or devices affected: [describe only what is necessary]
Other recipients or victims known: [yes/no/unknown]
Requested follow-up: [block, investigate, remove, preserve logs, contact me]
Reporter contact: [safe email or phone, if follow-up is appropriate]For an internal report, add the device name, user account, network location, and relevant alert or ticket number according to your organization’s policy. Avoid sending passwords or full payment-card details in a report. Your security team can request sensitive information through a safer process.
Common mistakes
- Deleting immediately: Deletion removes context that may help identify related messages. Preserve the original first when safe.
- Forwarding without warning: A recipient may click accidentally. Mark the message clearly as suspicious and use your organization’s reporting workflow.
- Investigating by interacting: Replying, calling, logging in, or opening an attachment can increase exposure and contaminate evidence.
- Reporting only to a general authority: A broad report does not replace contacting the bank, employer, platform, or provider that can secure the affected account or service.
- Overstating attribution: Report observable behavior and preserve uncertainty about who operates a domain or account.
- Assuming a report fixes the account: Reporting helps investigation, but it does not automatically reset credentials, reverse payments, or remove unauthorized access.
When to revisit
Revisit this workflow whenever a reporting destination, internal escalation process, email platform, mobile carrier, or security tool changes. Review it before seasonal campaigns that commonly produce delivery, tax, payroll, travel, charity, or account-renewal scams. Teams should also test the reporting path before an incident: confirm where employees forward suspicious email, how screenshots and original messages are stored, who can isolate an account, and who communicates with customers.
After each report, record the outcome without retaining unnecessary personal data: destination used, evidence submitted, case number if provided, containment steps, and whether a related message appeared later. If the same lure returns with a new sender or domain, submit it as a new observation and reference the earlier report. For larger environments, connect these records to a documented security alert triage process.
Practical next step: save the report template in your notes or incident-management system, verify your organization’s official reporting channel today, and use the checklist the next time you receive a suspected phishing scam alert. Report the message only after preserving the evidence and securing any account or payment that may be at risk.
