Report a suspicious Gmail message without opening its links

A phishing message might imitate a document invitation, shipping notice or security warning. Reporting helps the mail provider classify it, but the report button does not undo a password you already entered or warn every colleague who received the same message. Separate the routine inbox action from incident response.

Handle the message safely​

1. Do not use the message's links, attachment or reply address. If the claim might be genuine, open the organization's known site or app in a new tab and check there.
2. In Gmail on a computer, open the message without interacting with its content, select the More menu next to Reply and choose Report phishing. If Gmail had flagged a legitimate message incorrectly, its menu also offers Report not phishing.
3. In a work account, follow your organization's reporting channel as well. A local report may not reach your security team in the form they need. Include sender, subject, time and what action you took, without forwarding dangerous links to colleagues.
4. If you entered credentials, change them from the legitimate site, review active sessions and recovery methods, and tell the security team promptly. If you downloaded software, do not assume reporting the email removes it.

What Gmail receives​

Google's phishing-report instructions show the computer steps. It says that when a message is moved to Spam, Google may receive a copy and attachments for abuse analysis. Consider your workplace's data-handling rules if the message contains sensitive material. Reporting is useful for filters, while an account or device exposure needs its own response.