Suspected phishing email - reporting

Summary

This guide helps you troubleshoot and resolve: Suspected phishing email - reporting. Follow the steps below to fix the issue.

Common Causes

Problem

You received an email that looks suspicious – it could be a phishing attempt to steal your credentials or infect your computer with malware.

What is Phishing?

Phishing emails try to trick you into:

• Clicking malicious links
• Downloading malware
• Providing passwords, credentials, or financial information
• Transferring money or sensitive data

Red Flags to Watch For

• Urgent or threatening language (e.g., “Your account will be closed!”)
• Suspicious sender (e.g., support@company‑secure.com instead of support@company.com)
• Requests for sensitive information (passwords, bank details, employee data)
• Mismatched URLs – hover over links to see the real destination
• Poor spelling and grammar
• Unexpected attachments from unknown senders
• Too good to be true offers

How to Report a Phishing Email

Method 1 – Outlook built‑in report feature (recommended)

Outlook for Windows (new ribbon)

1. Select the email in your inbox.
2. In the top ribbon, click Junk ► Report as phishing. If you see “Mark as phishing” under the Junk menu, use that option.
3. Confirm the prompt, then delete the message.

Outlook for Mac

1. Select the message in your inbox.
2. Choose Message ► Junk ► Mark as phishing.
3. Confirm, then delete the email.

Outlook on the web (OWA)

1. Open the suspected message.
2. Click the … (more actions) button at the top right.
3. Select Mark as phishing (or Report phishing if your tenant has Defender for Office 365 enabled).
4. Confirm and then delete the message.

Outlook mobile (iOS & Android)

1. Tap and hold the message, then tap the three‑dot menu.
2. Select Report phishing (or Mark as junk → Report phishing).
3. Delete the message after reporting.

Method 2 – Forward to the IT Security Team

1. Forward the entire email, including full email headers, to security@220.com.au.
2. Do not click any links or open attachments before forwarding.
3. Use the subject line: Suspected Phishing – [brief description].
4. In the body, add any context (e.g., “Received from unknown sender claiming to be …”).

Method 3 – Microsoft “Report Message” add‑in

1. If the “Report Message” button is visible in the ribbon, click it and choose Phishing.
2. If the add‑in is missing, install it from the Office Store:
   1. Open Outlook and go to Home ► Get Add‑ins (or Store).
   2. Search for “Report Message”.
   3. Click Add and follow the prompts to install.
3. The email will be reported to Microsoft and to our IT team.

Method 4 – Native mobile mail apps (iOS Mail, Android Gmail, etc.)

1. Do not open links or download attachments.
2. Use the app’s “Forward” function to send the original message (including headers, if the app allows) to security@220.com.au.
3. If you cannot forward the full headers, forward the visible content and immediately open an IT ticket (see “Need More Help?”).

How to View Email Headers

Outlook for Windows

1. Open the message.
2. Click File ► Properties.
3. In the “Internet headers” box, press Ctrl +A, then Ctrl +C to copy.

Outlook for Mac

1. Open the message.
2. From the menu bar choose View ► Message ► All Headers.
3. Select the header text, copy, and paste into your forward.

Outlook on the web (OWA)

1. Open the message.
2. Click the three‑dot menu ► View message source.
3. A new tab shows the full headers – copy all of it.

Outlook mobile

1. Open the message, tap the three‑dot menu, and choose View source (if available) to copy the headers.

iOS Mail / Android Gmail

1. Open the message details (usually “More” ► “Show original” or “View full headers”).
2. Copy the displayed text and include it in your forward.

If You Think Your Credentials Are Compromised

Immediately reset your password using the self‑service portal. After resetting, run a quick Windows security scan and install any pending updates. Finally, clear your browser cache and cookies (how‑to‑clear‑browser‑cachecookies) before logging in again.

What to Do If You’ve Clicked a Suspicious Link

1. Don’t panic – act quickly.
2. Do not enter any passwords or credentials.
3. Disconnect from the internet (disable Wi‑Fi/Ethernet).
4. Do not download or run anything from the email.
5. Run a quick malware scan. See Antivirus alerts – what to do for guidance.
6. Contact IT immediately by opening a ticket and explain what happened.
7. Change your passwords from a different, trusted device.
8. Monitor your accounts for unusual activity.

What NOT to Do

After Reporting

• IT will investigate the email.
• The malicious sender may be blocked.
• Additional warnings may be sent to the organisation.
• You did the right thing by reporting.

Need More Help?

If you have clicked a link, provided information, are unsure whether an email is legitimate, or notice unusual account activity, please open a ticket.

Still Having Issues?