Phishing Emails: How to Recognize and Report Them Fast

Your bank sends you an alert. Unusual login detected. Click here to verify your identity. The logo is right, the colors look right, the footer has the usual legal disclaimers. You're tired, it's late, and for half a second your thumb hovers over the link. That half-second is the entire attack. Nobody outsmarts phishing with intelligence. You outsmart it with a habit you build before the email arrives.

I've worked on the receiving end of these campaigns for years now — reviewing reported messages for a mid-sized company, coaching colleagues through the "did I just click that?" panic, and cleaning up the mess when someone did. I've watched a finance director nearly wire a five-figure sum to a "supplier" whose email domain differed from the real one by a single letter. I've also watched a junior employee spot that same trick in four seconds flat, because she'd been burned once before and never forgot it.

What follows is the version of this advice I actually give people. Not the tidy checklist you've read a dozen times. The one with the reasoning behind it, the parts most guides skip, and the reporting channels that genuinely work in 2026.

How to recognize a phishing email without falling for the obvious traps

Most advice tells you to look for typos and bad grammar. That advice is out of date. The campaigns I see now are grammatically flawless — often better written than internal emails. The old tells have been automated away.

So what actually gives a phishing email away? Not the text. The relationship between the request and the story.

The real signal behind the obvious flags

A phishing email always asks you to do something that a legitimate sender wouldn't ask through email. Verify your password via a link. Confirm a payment by replying. Open an attachment to see an "unpaid invoice." Real institutions don't do this. Your bank doesn't need you to click a link to "reactivate" your account — it can just reactivate it. Microsoft doesn't email you to confirm your Microsoft password through a form.

The moment you notice the request itself is off, the rest of the email falls apart. You stop looking at the logo and start asking: why would this person need this from me, right now, through this channel?

What is a generic greeting in a phishing email an indicator of?

A generic greeting — "Dear Customer," "Dear User," "Hello" with no name — is a weak but useful indicator. Legitimate companies you have an account with usually know your name and use it. Phishing campaigns often don't, because they're blasted at thousands of addresses harvested from a leak, and they can't personalize what they don't know.

But be careful here. The generic greeting is a soft signal, not a verdict. Plenty of legitimate transactional emails open with "Hello" or nothing at all. And the reverse is also true: once a scammer has your name from a data breach, they'll use it, and the greeting will look perfectly normal. Treat the missing name as one point on a scoreboard, never as the deciding factor.

The link behind the link

Hover over any link before you click it — on desktop, that's just resting your cursor on it; on mobile, press and hold. The visible text says yourbank.com. The actual destination might be yourbank.secure-login-verify.xyz. The domain after the last dot is the one that matters. Everything before it is decoration.

Watch for homoglyph attacks too. In a hurry, rn reads as m, and paypa1.com with a numeral one looks like the real thing at thumbnail size. On a phone screen, in a notification tray, these differences vanish.

• Check the full destination, not the display text
• Look at the domain immediately to the left of the top-level domain — that's the real sender
• Be suspicious of subdomains that mimic a brand: paypal.com.verify-now.net is not PayPal
• Yes, HTTPS now appears on phishing sites too — the padlock means nothing about intent in 2026

Attachments and the urgency engine

Urgency is the load-bearing wall of every phishing campaign. "Your account will be closed in 24 hours." "Confirm this payment before 5 p.m. or it will be declined." The deadline exists to prevent you from thinking. Real organizations almost never give you a two-hour window to save your own account.

Attachments deserve their own caution. An invoice, a delivery note, a "secure document" you weren't expecting — these are common delivery vehicles for malware. The file extension matters: .exe, .scr, .js, .iso, and macro-enabled Office files should trigger an immediate stop. But even a "harmless" PDF can carry a malicious link.

Is it better to report the phishing emails or just delete them?

Report. Every time. I know deleting feels faster, and I know the report button sometimes vanishes mid-campaign (more on that below). But deleting does one thing for one person — it clears your inbox. Reporting does three things for everyone on your domain.

When you report a message through your email provider's button, you feed the spam filter a labeled example. Filters learn from patterns. One report from you might be the data point that catches the same campaign before it reaches a colleague tomorrow. On a corporate domain with a dedicated abuse mailbox, a report often triggers an automated sweep: the security team blocks the sender, quarantines matching messages already delivered, and adds a warning banner for anything similar that slips through.

Here's the part most people don't see: phishing campaigns rarely hit a single inbox. They hit the same address list. If you got the email, so did two or three colleagues, and one of them is less suspicious than you and more tired. Your report might be what stops that person from clicking.

How and where to report phishing emails

The channel depends on where you received the message and who you are. Here's the practical map.

How to report phishing emails in Outlook

In the current Outlook client — desktop and web — the report button lives in the ribbon at the top of an open message. Find it under Report Message, where you'll typically see two options: Junk and Phishing. Choose Phishing. That sends the message to Microsoft's detection service and, if your organization has configured it, to your internal security team as well.

If your tenant hasn't enabled the add-in, the button simply won't exist. That's not a bug on your end. Ask your IT admin to deploy the Report Message add-in from the Microsoft 365 admin center — it's a five-minute configuration and it makes reporting actually possible.

Why did the Report phishing button in Outlook disappear?

The button vanishing is almost always a configuration change, not a personal problem. Common causes: an admin pushed a policy that removed the add-in, an Office update reset the ribbon layout, or you're using a different Outlook version (the new Outlook versus classic) where the location moved. If the button is gone, don't improvise — check with your IT team first, then forward the message manually to your organization's abuse mailbox.

How to report phishing emails in Gmail on your phone

Open the message, tap the three-dot menu in the top right, and select Report phishing. Gmail doesn't need you to explain; it uses the report to tighten filtering across all accounts. If the message is in spam already and clearly fraudulent, opening it and reporting still helps — but don't tap any links inside it.

Where to send it beyond your inbox

Beyond the platform button, there are public channels worth knowing. In the United States, the FTC runs ReportFraud.ftc.gov and the Anti-Phishing Working Group accepts forwarded messages at [email protected]. In the United Kingdom, the NCSC runs a dedicated Suspicious Email Reporting Service at [email protected]. In France, signal-spam.fr handles the same job. If the message impersonates a specific company, forward it to that company's abuse address too — most banks publish one.

None of these replace reporting internally. They feed separate pipelines: one protects your organization, the other protects the wider ecosystem.

If you suspect you've received a phishing email, or worse, interacted with it

You clicked. It happens. The question is what you do in the next sixty minutes.

First, disconnect the shame reflex — it's the single biggest reason people delay. I've seen a senior manager sit on a compromised credential for two days because he was embarrassed, and that delay turned a password reset into a full account takeover.

1. Change the password for the affected account immediately, from a different device if possible
2. Turn on multi-factor authentication if you haven't — this single step kills the majority of credential-based follow-up attacks
3. If you entered financial details, call your bank's fraud line within the hour. Speed beats caution here
4. Check your account's sent items, forwarding rules, and recovery email — attackers routinely leave a forwarding rule in place to keep receiving your mail
5. Tell your IT or security team. Yes, even if you feel foolish. They need to know to sweep the rest of the network

If you opened an attachment rather than clicking a link, run a full antivirus scan and disconnect from the network until you've done it. If you replied with any sensitive information, treat everything in the reply as compromised.

Is it worth reporting phishing emails?

Yes — and I'll be honest about the limits of that answer. Reporting won't recover your time. It won't always result in a visible consequence. Sometimes you'll report a message into an automated void and never hear a word back.

But the alternative — a silent delete — means nobody learns anything. Spam filters are only as good as the data they're given. Abuse mailboxes are only as responsive as the reports they receive. The collective defense against phishing is built from millions of small, boring clicks on a report button, most of which never get acknowledged.

So do the boring click. Then do it again next week. The habit is the defense. And if you want one thing to carry away from all of this: the best way to recognize a phishing email is not to memorize a list of tells. It's to notice, every single time, that something is asking you to act quickly, privately, and through the wrong channel — and to stop long enough to ask why.

That pause is the whole game.