How to Spot and Report a Phishing Email in Outlook
"Your account will be suspended." "Your parcel couldn't be delivered." "Invoice attached — please pay today." Phishing emails are designed to make you act before you think. A few seconds of checking stops almost all of them — and Outlook's Report button helps protect everyone else too.
Quick reference
| Check | How |
|---|---|
| Sender's real address | Hover over or click the name at the top |
| Link's real destination | Hover over it and look at the bottom-left of the window |
| Report it | Report → Report phishing |
| Not sure? | Contact the company another way — never via the email |
1. Six signs it's phishing
1. Urgency or threats — "within 24 hours", "account locked", "final notice". Real companies rarely work like that.
2. The address doesn't match the name — HMRC from hmrc-refunds@gmail.com, Microsoft from security@micros0ft-alerts.net.
3. A generic greeting — "Dear Customer", "Dear User". Your bank knows your name.
4. Links that go somewhere odd — see section 3.
5. Unexpected attachments — especially .zip, .html or Office files asking you to Enable content.
6. Something's slightly off — a logo that's blurry, odd spacing, a tone that's not quite right. Trust the feeling.
2. The address doesn't match the name — HMRC from hmrc-refunds@gmail.com, Microsoft from security@micros0ft-alerts.net.
3. A generic greeting — "Dear Customer", "Dear User". Your bank knows your name.
4. Links that go somewhere odd — see section 3.
5. Unexpected attachments — especially .zip, .html or Office files asking you to Enable content.
6. Something's slightly off — a logo that's blurry, odd spacing, a tone that's not quite right. Trust the feeling.
2. Check the real sender address
The name at the top of an email can say anything. The address is what matters.
• New Outlook / web: hover over or click the sender's name. A card shows the full email address.
• Classic Outlook: the address shows next to the name in the reading pane, or hover over the name.
• Phone: tap the sender's name.
• Classic Outlook: the address shows next to the name in the reading pane, or hover over the name.
• Phone: tap the sender's name.
Look at the part after the @ and read it carefully, right to left: paypal.com is PayPal; paypal.com-secure-login.info is not — the real domain there is com-secure-login.info.
3. Check where a link really goes
Don't click. Hover the mouse over the link and look at the bottom-left corner of the Outlook window — the real web address appears there. If the text says amazon.co.uk and the address starts with something else, it's a scam. On a phone, long-press the link to see the address without opening it.
Shortened links (bit.ly and so on) hide the destination — treat them with suspicion in unexpected emails.
4. Report it
Reporting trains Microsoft's filters and alerts your IT team.
• New Outlook / web: select the email and click Report → Report phishing on the toolbar (or right-click → Report → Report phishing).
• Classic Outlook: Home → Report Message → Phishing (Microsoft 365), or Junk → Report Phishing / Block.
• Phone: tap ⋯ → Report → Phishing.
• Classic Outlook: Home → Report Message → Phishing (Microsoft 365), or Junk → Report Phishing / Block.
• Phone: tap ⋯ → Report → Phishing.
The email is sent to Microsoft and deleted from your inbox. If your organisation has a security team, they're notified too.
For scams pretending to be UK organisations, you can also forward the email to report@phishing.gov.uk — the National Cyber Security Centre takes down the sites.
5. If you clicked
It happens. Act quickly:
1. Disconnect from Wi-Fi if you opened an attachment, and run a full antivirus scan.
2. Change your password on the account the email was about — and anywhere else you used the same password.
3. Turn on two-step verification for that account if you haven't.
4. Check your Outlook rules (Settings → Mail → Rules) for forwarding rules you didn't create — attackers add them to read your mail.
5. Tell IT if it's a work account. Nobody will think less of you; they'll think less of you for not saying.
2. Change your password on the account the email was about — and anywhere else you used the same password.
3. Turn on two-step verification for that account if you haven't.
4. Check your Outlook rules (Settings → Mail → Rules) for forwarding rules you didn't create — attackers add them to read your mail.
5. Tell IT if it's a work account. Nobody will think less of you; they'll think less of you for not saying.
6. Protect yourself in advance
• Turn on two-step verification for your Microsoft account and your email provider.
• Use a password manager so each site has a different password.
• Keep Windows and Outlook updated.
• Teach the people you live with — the over-70s and the under-20s are the most targeted groups.
• Use a password manager so each site has a different password.
• Keep Windows and Outlook updated.
• Teach the people you live with — the over-70s and the under-20s are the most targeted groups.
Troubleshooting
The Report button isn't there. Your toolbar may be too narrow — look under ⋯. In classic Outlook, your organisation may need to add the Report Message add-in; use Junk → Report Phishing meanwhile.
I reported something that turned out to be genuine. No harm done. Check Junk Email or Deleted Items to recover it, and add the sender to Safe senders.
I keep getting the same scam. Report each one — don't just delete. Block the sender too, though scammers change addresses constantly.
Wrapping up
Pause, check the address after the @, hover over the link, and when in doubt go to the company's website yourself. Then click Report phishing so the next person doesn't have to work it out.
