Report it in three places
- In your email app. In Outlook, select the message and use Report (or Report phishing). In Gmail, open the three-dot menu and select Report phishing. This trains your filters and, at work, alerts your IT team’s security tools.
- To the NCSC. Forward the email to report@phishing.gov.uk. The National Cyber Security Centre analyses it and works with hosting companies to take down the malicious websites it links to.
- To your IT provider, if it arrived at work. They can find and remove the same message from colleagues’ inboxes and block the sender.
Then delete it. Do not reply, click links or open attachments while you report it.
How to spot one
- Urgency or threat — your account will close, a payment has failed, a parcel is waiting.
- A request to change bank details, especially from a “supplier” or “director”. This is the most expensive kind of email fraud for UK businesses.
- A mismatched sender — the display name says one thing and the address another, or the reply goes to a different domain.
- Links that go somewhere unexpected — hover over a link to see the real address before clicking.
Not sure? Paste the message headers into our free email header analyser to see whether it really came from who it claims, and check whether replies are being redirected.
If you clicked, replied or paid
- Entered a password: change it straight away, and anywhere else you use it. Turn on multi-factor authentication. At work, tell IT immediately — they can sign out every session.
- Opened an attachment: disconnect the computer from the network and call IT before doing anything else.
- Paid or shared bank details: call your bank at once using the number on your card or statement. Then report it to Report Fraud at reportfraud.police.uk or on 0300 123 2040 (England, Wales and Northern Ireland), or to Police Scotland on 101.
- Replied with information: warn whoever might be targeted next — your finance team, your clients — that someone may contact them pretending to be you.
If the email used your own domain, or a lookalike of it, to trick your customers, check your domain’s protection with the DMARC checker. Our page on business email compromise explains how these scams work and the controls that stop them.