Reporting a phishing email to Microsoft helps protect your own mailbox and improves Microsoft filters for other people. Use the built-in Outlook report option when you have it.
Does this affect you?
Use this for suspicious messages pretending to be Microsoft, Outlook, Office, Microsoft 365, OneDrive, or account security alerts.
Report it from Outlook
This is the fastest and most useful method in Outlook.
- Open the suspicious message without clicking links or downloading attachments.
- In Outlook.com or Outlook desktop, select Report in the toolbar or ribbon.
- Choose Report Phishing, not just Junk, when the message impersonates a company or tries to steal information.
- In the Outlook mobile app, open the message, tap the three-dot menu, then choose Report Junk > Phishing.
- Confirm the report. Outlook moves the message and sends a copy to Microsoft for analysis.
Forward it to Microsoft
Use this if you are not in Outlook but the message impersonates Microsoft.
- Open the suspicious email.
- Forward it as an attachment if your email client supports that, because headers help trace the sender.
- Send Office 365 phishing attempts to Microsoft’s phishing-report address and spam to Microsoft’s spam-report address as listed in Microsoft documentation.
- If attachment forwarding is not practical, forward normally with a note that it appears to be phishing.
- Do not expect an individual reply; submissions feed filtering systems.
More control
If you entered credentials
Change the Microsoft account password at account.microsoft.com immediately and enable two-factor authentication if it is not already on.
Report fake login pages
If the email linked to a fake Microsoft page, submit the URL at report.microsoft.com so SmartScreen can block it.
Do not reply
Replying to a scam confirms your address is active and can invite more targeted attempts.
Microsoft 365 admins can centralize reports
Organizations can deploy Microsoft’s Report Message or Report Phishing add-ins so user reports flow into Defender for Office 365.
Sources
- Microsoft Support – Report messages and files to Microsoft (2025)
- Microsoft – How to recognize phishing (2025)
- CISA – Avoiding social engineering and phishing attacks (2025)