Suspected phishing email - reporting

Summary

This guide helps you troubleshoot and resolve: Suspected phishing email - reporting. Follow the steps below to fix the issue.

Common Causes

Problem

You received an email that looks suspicious – it could be a phishing attempt to steal your credentials or infect your computer with malware.

What is Phishing?

Phishing emails try to trick you into:

• Clicking malicious links
• Downloading malware
• Providing passwords, credentials, or financial information
• Transferring money or sensitive data

Red Flags to Watch For

• Urgent or threatening language (e.g., “Your account will be closed!”)
• Suspicious sender – check the actual email address by clicking on the sender name to reveal it
• Requests for sensitive information (passwords, bank details, employee data)
• Mismatched URLs – hover over links to see the real destination
• Poor spelling and grammar
• Unexpected attachments from unknown senders
• Too good to be true offers

How to Report a Phishing Email

Method 1 – Outlook built-in report feature (recommended)

Outlook for Windows (new ribbon)

1. Select the email in your inbox.
2. In the top ribbon, click Junk ► Report as phishing. If you see “Mark as phishing” under the Junk menu, use that option.
3. Confirm the prompt, then delete the message.

Outlook for Windows (classic ribbon)

1. Select the email in your inbox.
2. Click the Junk button in the ribbon.
3. Select Report as phishing or Mark as phishing from the dropdown.
4. Confirm the prompt, then delete the message.

Outlook for Mac

1. Select the message in your inbox.
2. Choose Message ► Junk ► Mark as phishing.
3. Confirm, then delete the email.

Outlook on the web (OWA)

1. Open the suspected message.
2. Click the … (more actions) button at the top right.
3. Select Mark as phishing (or Report phishing if available).
4. Confirm and then delete the message.

Outlook mobile (iOS & Android)

1. Tap and hold the message, then tap the three-dot menu.
2. Select Report phishing (or Mark as junk followed by Report phishing).
3. Delete the message after reporting.

Method 2 – Forward to the IT Security Team

1. Forward the entire email, including full email headers, to [email protected].
2. Do not click any links or open attachments before forwarding.
3. Use the subject line: Suspected Phishing – [brief description].
4. In the body, add any context (e.g., “Received from unknown sender claiming to be …”).

How to View Email Headers

Outlook for Windows

1. Open the message.
2. Click File ► Properties.
3. In the “Internet headers” box, press Ctrl + A, then Ctrl + C to copy.

Outlook for Mac

1. Open the message.
2. From the menu bar choose Message ► Headers ► All Headers.
3. Select the header text, copy, and paste into your forward.

Outlook on the web (OWA)

1. Open the message.
2. Click the three-dot menu ► View message source.
3. A new tab shows the full headers – copy all of it.

Native mobile mail apps

1. Do not open links or download attachments.
2. Use the app’s “Forward” function to send the original message to [email protected].
3. If you cannot forward the full headers, forward the visible content and open an IT ticket.

If You Think Your Credentials Are Compromised

1. Immediately reset your password using the self-service portal.
2. Enable multi-factor authentication (MFA) if it is not already active.
3. Check your email account for any unexpected forwarding rules that may have been created.
4. Run a security scan on your computer.
5. Clear your browser cache and cookies before logging in again.

What to Do If You’ve Clicked a Suspicious Link

1. Don’t panic – act quickly.
2. Do not enter any passwords or credentials on the page.
3. Disconnect from the internet (disable Wi-Fi/Ethernet).
4. Do not download or run anything from the email.
5. Run a quick malware scan.
6. Contact IT immediately by opening a ticket and explain what happened.
7. Change your passwords from a different, trusted device.
8. Monitor your accounts for unusual activity.

What NOT to Do

After Reporting

• IT will investigate the email.
• The malicious sender may be blocked.
• Additional warnings may be sent to the organisation.
• You did the right thing by reporting.

Serious Incidents

For serious security incidents, you may also report to the Australian Cyber Security Centre via ReportCyber.

Need More Help?

If you have clicked a link, provided information, are unsure whether an email is legitimate, or notice unusual account activity, please open a ticket.

Still Having Issues?