How to Report Phishing Emails

Once your Manager has set up the Phish Reporter Service in your environment (Microsoft 365 or Google Workspace), you’ll be able to report suspicious emails quickly and safely.

Overview: Reporting Options

Option	Environment	Learner Action
1. Manual Forwarding	All (Recommended for Google Workspace)	Forward the suspicious email to your organisation's designated mailbox (e.g., phishreport@yourdomain.com).
2. Microsoft Report Button	Microsoft 365	Click the built-in Report Phishing button directly from the inbox.

❓ Unsure Which Method to Use?

If you are unsure of which method to use to report emails, please reach out to your Admin Manager, MSP Account Manager, or Goldphish Account Manager for confirmation.

Option 1: Microsoft 365 – Using the Report Phishing Button

If your organisation uses Microsoft 365 and the Report Phishing button has been enabled, here’s how to report a suspicious email:

How to Report a Phishing Email in Outlook:

Open the suspicious email.
Tap or click the Report Phishing button (available in Outlook desktop, web, and mobile).
Confirm when prompted.

Where to find the Report Phishing button:

Outlook Desktop (full program): In the main toolbar/ribbon.
Outlook on the Web: In the sidebar or a menu within the email view.
Outlook Mobile App: Open the email → tap the three dots (…) → choose Report Phishing.

Option 2: Google Workspace & Manual Forwarding

If you’re a Google Workspace user, please follow these steps:

How to Report a Phishing Email in Gmail

Open the suspicious email.
Manually forward the email to the designated organisational reporting address (e.g., phishreport@yourdomain.com).

Important for Google Workspace Users: The built-in Gmail "Report phishing" button does not work for tracking our simulated phishing tests. You must manually forward suspicious emails.

General Guidelines for Reporting

Please report anything suspicious – even if you’re unsure.

Do This ☑️	Don't Do this❌
Report emails even if you think they're a simulated phishing test- you'll get high fives.	Don't click on any links in a suspicious email.
When in doubt, report it!	Don't open any attachments in a suspicious email.

By reporting suspicious emails, you help protect yourself, your colleagues, and our organisation from cybercrime.