Short answer
Don’t click, reply or log in. In Gmail, open the message and choose More → Report phishing; in Outlook, select it and choose Report → Report phishing. Report a fake website to Google Safe Browsing. Forward fake Facebook or Meta emails to phish@fb.com and use Amazon’s Report a Scam page for fake Amazon messages. In the UK, forward emails to report@phishing.gov.uk and texts to 7726; in the US, forward emails to reportphishing@apwg.org, texts to 7726, and report at ReportFraud.ftc.gov. If you already entered a password or code, change it now and sign out other sessions.
Report it where it arrived
- Gmail: open the message → next to Reply, More → Report phishing.
- Outlook.com: select the message → Report → Report phishing. Reporting doesn’t block the sender; add them to blocked senders too.
- Facebook/Meta: forward suspicious emails to phish@fb.com. Meta says it never asks for your password by email.
- Amazon: check whether the message appears in your Amazon Message Center, and use Amazon’s Report a Scam page if it doesn’t.
Report the fake website
Google’s Safe Browsing team takes reports of phishing pages through its online form. If Google finds that a page breaks its policies, it can update the site’s status and share it with others that rely on Safe Browsing.
Report it to the authorities
- United Kingdom: forward emails to report@phishing.gov.uk (the NCSC’s Suspicious Email Reporting Service) and texts to 7726; scam websites go through the NCSC’s website form.
- United States: forward emails to reportphishing@apwg.org, texts to SPAM (7726), and report at ReportFraud.ftc.gov.
- Other countries: where to report online fraud by country.
If you clicked or typed something in
- Change the password on that account — and anywhere you reuse it.
- Sign out other sessions: who else is logged in?
- If you gave a two-factor code, assume the attacker is in; for Meta accounts report it at facebook.com/hacked even if you can still log in.
- If card or bank details were entered, call your bank now.
Spot the next one
Real companies don’t email or text you a link to “update payment details” out of the blue. Look-alike sender domains, urgency and missing names are the classic signs — see fake Meta and Instagram emails and account recovery scams. Our hacked account recovery service works only through official channels.
Frequently asked questions
How do I report a phishing email in Gmail?
Open the message, select More next to Reply, then Report phishing.
Where do I forward a fake Facebook or Instagram email?
To phish@fb.com. Meta sends email only from its own domains, such as facebookmail.com, meta.com and instagram.com.
Where do I report phishing in the UK?
Forward emails to report@phishing.gov.uk and texts to 7726. The NCSC has a separate form for scam websites.
I typed my password into a phishing page — what now?
Change the password immediately, sign out other sessions, turn on two-step verification and check the account’s recovery email and phone.
Sources: Gmail Help — avoid and report phishing emails, Google Safe Browsing — report a phishing page, Microsoft Support — report phishing or junk email, Facebook Help — suspicious emails claiming to be from Facebook, Amazon — how to identify fake emails, NCSC — report scam emails, texts and websites, FTC — how to recognize and avoid phishing scams