Security & Good Practice
Recognizing and Reporting Phishing Emails
This guide shows you how to identify suspicious phishing emails and how to report them correctly so your IT team can protect the whole organisation.
Time needed
10 minutes
Platform
Microsoft 365
Guide steps
3 clear sections
Before you begin
You are signed in to Outlook and using your work email.
Follow along
Step-by-step guide
Recognise the warning signs of a phishing email
- Instruction 1: Unexpected urgency: the email creates pressure to act immediately (e.g. 'Your account will be closed in 24 hours', 'Immediate action required').
- Instruction 2: Sender address mismatch: the display name looks right (e.g. 'Microsoft Support') but the actual email address is suspicious (e.g. support@microsoft-helpdesk.xyz). Hover over the sender's name to see the real address.
- Instruction 3: Links that go somewhere unexpected: hover over any link before clicking — the address shown at the bottom of your browser should match the company mentioned. Be especially wary of shortened URLs.
- Instruction 4: Generic greetings: 'Dear Customer' or 'Dear User' instead of your actual name.
- Instruction 5: Requests for credentials, payment details, or sensitive information — Microsoft, your bank, and legitimate organisations will never ask for your password via email.
- Instruction 6: Poor spelling and grammar, or an odd tone that seems unlike the supposed sender.
Action map
Recognise the warning signs of a phishing email
- 01
Unexpected urgency: the email creates pressure to act immediately (e.g. 'Your account…
- 02
Sender address mismatch: the display name looks right (e.g. 'Microsoft Support') but the…
- 03
Links that go somewhere unexpected: hover over any link before clicking — the address…
Visual guide
Use this visual action map alongside the written instructions above.
Open Microsoft security guidance for Recognizing and Reporting Phishing EmailsWhat to do if you receive a suspicious email
- Instruction 1: Do not click any links or open any attachments in the email.
- Instruction 2: Do not reply to the sender.
- Instruction 3: If the email appears to be from a known contact (e.g. your CEO, your bank, a supplier), contact that person by phone or a new separate email to verify — do not reply to the suspicious email.
Report a phishing email in Outlook
- Instruction 1: In Outlook on the web: select the email (do not open it if possible), then click the Report button in the toolbar (it looks like a flag or shield). Choose Report phishing.
- Instruction 2: In Outlook desktop: open or select the email, then click the Report Message button in the ribbon (you may need to look in the Home or Message tab). If you do not see this button, click the three-dot menu in the email and look for Report. Choose Phishing.
- Instruction 3: Once reported, the email is moved to your Junk folder and the report is sent to Microsoft and potentially to your IT team, depending on your organisation's configuration.
- Instruction 4: If you are uncertain whether an email is phishing, forward it to the helpdesk and ask them to check it — it is always better to report a legitimate email than to miss a real phishing attempt.
Quick fixes
Troubleshooting
I already clicked a link in a suspicious email
Do not enter any credentials or information on the page that opened. Close the browser tab immediately. Contact the helpdesk straight away and tell them what happened, what link you clicked, and whether you entered any information. They will check your account for signs of compromise and may need to reset your password.
The Report Message button is not in my Outlook ribbon
The button may need to be enabled by your IT administrator. Contact the helpdesk. In the meantime, forward suspected phishing emails to the helpdesk email address for manual review.
Still need a hand?
Our support team can help with Microsoft 365.
Tell us where you got stuck and what you see on screen.