How to spot and report a phishing email in Outlook

Five warning signs

1. Urgency or pressure. “Pay today”, “your account will be closed”, “the CEO needs this now”.
2. A sender address that’s slightly off. One letter changed, an extra word, or a free email address pretending to be a company.
3. A link that doesn’t go where it says. Hover over it (or press and hold on a phone) to see the real address before you click.
4. An unexpected attachment or “shared document”. Especially one that asks you to sign in to view it.
5. A request to change payment details or buy gift cards. Always confirm by phone, using a number you already have.

Report it in Outlook

Outlook has a built-in Report button on computers, the web and phones.

• New Outlook and Outlook on the web: select the message, click Report on the toolbar, then Report phishing.
• Classic Outlook for Windows and Mac: select the message, click Report on the Home ribbon, then Report phishing. Some offices use a reporting add-in instead, which looks slightly different.
• Outlook on iPhone and Android: open the message, tap … at the top, then Report phishing.

Reporting moves the message out of your inbox and helps Microsoft (and your IT provider, if they’ve set it up) block similar messages.

Then

• Delete it if it’s still there. Don’t forward it to coworkers to ask “is this real?”
• If it looks targeted at your office, such as a fake invoice from a real vendor, warn your team.

If you already clicked

Don’t panic, and don’t hide it. The first few minutes matter most.

1. Tell your IT contact straight away.
2. If you entered a password, change it from a different device, and change it anywhere else you use the same one.
3. If you approved a sign-in request you didn’t start, say so; your IT contact can sign you out everywhere.
4. If you opened an attachment, disconnect the computer from Wi-Fi or the network until it’s checked.
5. Watch for unexpected sign-in prompts or emails you didn’t send.

For owners

Short, regular security awareness training and practice phishing emails work better than a once-a-year lecture. Make reporting easy and never punish someone for reporting a mistake, so people speak up quickly.

Related

• Managed security and security awareness training
• Fake invoices with new bank details: how to stop the scam
• Multi-factor sign-in: a plain-English guide

More guides

• Microsoft 365 admin: add staff, reset passwords and offboard someone who leaves
• Microsoft 365 Copilot: what it does, where to find it, and how to use it safely
• Set up Microsoft Authenticator and Outlook on your phone (iPhone and Android)
• How to check your email's SPF, DKIM and DMARC records (and what the results mean)
• How to send an encrypted email in Outlook (Microsoft 365)
• What goes in a WISP: a checklist for small tax offices
• Share files with clients securely from OneDrive (expiring links, no attachments)
• Hand over HOA or office email when a board member or manager changes

Microsoft changes its menus from time to time, so a button may have moved. These guides are general information for small businesses; check with your IT provider before changing settings that affect everyone.