Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Use the reporting route that matches what you received: forward a phishing email to reportphishing@apwg.org and report it at ReportFraud.ftc.gov; forward a scam text to 7726 (SPAM) and the FTC; use your mail app’s phishing button; or report a fraudulent site through the browser or search service that displayed it. Preserve the original evidence first, do not click again, and contact the real organization immediately if you entered credentials or payment details.
Choose the right reporting route
The artifact determines where a report is most useful. Government agencies collect reports for investigations and consumer warnings, while mail providers, carriers, browsers, and search engines use reports to improve filtering or block harmful content.
| What you have | First-party route | Evidence to preserve | When to escalate immediately |
|---|---|---|---|
| Phishing email | Forward to reportphishing@apwg.org; report at ReportFraud.ftc.gov; use your mail provider’s phishing control | Original message, sender address, complete links, time received, screenshots, and headers if requested | Credentials, payment data, or work-account information was entered |
| Scam text message | Forward to 7726 (SPAM); report at ReportFraud.ftc.gov | Message text, sending number, links, screenshots, and time received | You replied, followed a link, shared a one-time code, or paid |
| Fake website or phishing domain | Report through the browser or search service that showed it; contact the impersonated company through a verified channel | Exact URL, screenshots, redirect sequence, search result or ad details, and access time | You entered a password, card number, identity data, or downloaded software |
| Impersonated business or organization | Notify the real organization; businesses can also use FTC, APWG, local law enforcement, and the FBI Internet Crime Complaint Center at IC3.gov | Copies of messages, domains, payment instructions, affected accounts, and customer-impact details | There is account takeover, financial loss, or a continuing campaign against customers |
These routes can operate in parallel. A carrier report does not replace an FTC report, and a mail-provider report does not notify the bank or employer being impersonated.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsPreserve evidence without exposing yourself
Collect evidence before deleting anything, but do not reopen a suspicious page merely to capture more information. If the message is still visible, save it in place and take screenshots without selecting links or attachments.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Keep the complete sender address or phone number, including unusual subdomains or country codes.
- Copy the full URL exactly as displayed. Do not visit it to verify that it is malicious.
- Record the date and time, your time zone, and where you encountered it (inbox, text thread, search result, advertisement, or social message).
- Capture screenshots that show the message, website address, payment request, and any warning displayed by your browser or mail service.
- For email, retain the original message. Some providers expose “show original,” “view source,” or header-download options; include headers only when the receiving service requests them.
- Note what you did: opened a page, downloaded a file, entered a password, supplied a verification code, called a number, or sent money.
Do not reply, negotiate, unsubscribe, or call a number in the message. Verify any claimed organization through a phone number on a payment card, account statement, or official website you type yourself.
Report a phishing email
Forward it to APWG and report it to the FTC
- Preserve the original email and its evidence as described above.
- Forward the phishing email to reportphishing@apwg.org. The FTC specifically says, “If you got a phishing email, forward it to the Anti-Phishing Working Group at reportphishing@apwg.org.”
- Submit a report at ReportFraud.ftc.gov. The FTC also says, “Report the phishing attempt to the FTC at ReportFraud.ftc.gov.”
- After reporting, delete the message if you no longer need it for an account, workplace, or law-enforcement investigation.
The APWG route helps researchers identify phishing campaigns. The FTC route records the consumer-fraud report. Neither route promises an individual response or guarantees that a domain will be taken down.
Include useful email evidence
Do not alter the forwarded message if the recipient needs its technical data. Include the visible sender, the address shown when you hover over links (without opening them), the destination URL, any attachment name, and the impersonated organization. If your provider asks for the original as an attachment rather than an inline forward, follow that instruction so headers are preserved.
Report a phishing text message
- Do not tap links, call the sender, reply, or download an attachment.
- Copy or forward the message to 7726 (SPAM). The FTC says, “If you got a phishing text message, forward it to SPAM (7726).” Most US mobile carriers use this short code to collect spam reports.
- Report the scam at ReportFraud.ftc.gov.
- After preserving the number, message, URL, and screenshots, delete or block the thread according to your phone’s controls.
A text that claims to be from your bank, delivery company, employer, or government office should be checked through that organization’s official app, website, or a number printed on a statement. Do not use contact details supplied in the text.
Use the built-in phishing controls in Gmail
- Open Gmail and select the suspicious message.
- Choose More (the three-dot menu).
- Choose Report phishing.
- Confirm the report when Gmail asks.
Google says reporting sends the message and its attachments to Google for analysis so Gmail can improve spam and abuse protection. Preserve a copy or screenshot first if you need the evidence for your employer, bank, or a police report.
Rank #2
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
Report phishing in Microsoft Outlook or Teams
Outlook
- Select the suspicious message.
- On the ribbon, choose Report > Report phishing.
- Submit the report and follow any confirmation prompt.
Microsoft’s instruction is: “With the suspicious message selected, choose Report > Report phishing from the ribbon.” Menu names can vary slightly between Outlook on the web, desktop, and mobile versions, but look for the report control attached to the selected message rather than opening a link.
Teams
- Open the message’s More options menu.
- Choose More actions > Report this message.
- Select the security-risk option and submit.
Other Microsoft mail clients
If you use another mail client in a Microsoft 365 environment, Microsoft asks you to attach the original suspicious email and send it to phish@office365.microsoft.com. Do not create a new message that merely quotes the text if the original attachment is available.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Report a fake website or phishing domain
Microsoft Edge
- Do not return to the site. Use a screenshot or the URL already visible in your history or message.
- In Edge, choose … > Help and feedback > Report unsafe site.
- Complete the form with the exact URL and explain whether it was a phishing page, malicious download, or suspicious redirect.
- Submit the report and close the tab.
Google Search results, ads, and redirects
For a phishing page, suspicious redirect, or phishing result or advertisement shown in Google Search, use Google’s Search reporting and webspam/reporting routes. Select the result or ad’s reporting option when available and provide the exact destination URL. Do not revisit the page merely to submit a report; report from the search result, browser history, or a screenshot instead.
Contact the site’s legitimate owner
If a domain copies a bank, retailer, employer, school, or other service, send the evidence to that organization through a verified website or phone number. Ask whether your account needs a reset or whether the organization has a dedicated abuse address. A hosting provider or registrar may receive abuse reports too, but a report does not guarantee immediate suspension, and the site may move to another domain.
If a business or organization is being impersonated
Tell the real organization first, using contact details obtained independently of the suspicious message. Include the spoofed logo or name, sender addresses and phone numbers, domains, payment instructions, affected customers, and the dates of the campaign.
Rank #3
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Businesses should report the incident to the FTC and APWG and may also notify local law enforcement and the FBI Internet Crime Complaint Center at IC3.gov. Preserve logs and customer communications according to your incident-response and legal-retention requirements. If employees received the message, warn them through a trusted internal channel and provide the verified reporting route.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What to do if you clicked or entered information
You clicked but entered nothing
Close the page, avoid downloading anything, and run a security scan if a file opened or a download started. Update the operating system, browser, and security software. Review browser extensions and downloads for anything you did not intentionally install.
You entered a password or verification code
- Use the real organization’s app or a manually typed official address, not the message’s link.
- Change the exposed password immediately. Make it unique; do not reuse it on another account.
- Change the password anywhere else it was reused, starting with email and financial accounts.
- Turn on multi-factor authentication. The FTC lists a security key as one possible second factor; a FIDO2 hardware security key can protect an account when the service supports it.
- Review active sessions, recovery email addresses, phone numbers, forwarding rules, and recently added devices. Sign out sessions you do not recognize.
You entered card or bank details or sent money
Call the bank, card issuer, or payment service using the number on the card or statement. Explain that the information was submitted to a phishing site and ask about freezing the card, stopping transfers, replacing credentials, and disputing unauthorized transactions. Monitor statements and alerts rather than waiting for a response from a reporting site.
You exposed Social Security or other identity information
Use IdentityTheft.gov for tailored recovery steps. Follow its instructions for fraud alerts, credit freezes, replacement documents, and account review as applicable to your situation.
You may have installed malware
Disconnect the affected device from sensitive accounts if practical, update its security software, and run a full scan. From a separate trusted device, change important passwords and inspect account activity. For a work device, contact your IT or security team before wiping or resetting it so evidence is not destroyed.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Rank #4
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- USB TYPE C Connectivity & DONGLE Design: Designed for PCs, Macs, laptops, iPhones, and Android devices that utilize a USB-C port. Plug and stay, or carry it on a keychain. (Item Size: 0.73 x 0.60 x 0.30 inches)
- Enhanced MFA (FIDO2 & TOTP/HOTP): Strengthen your security with flexible options. Use the Manager App to access TOTP/HOTP features for accounts that do not yet support FIDO2.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID. NFC functionality is not supported.
Build a report that others can act on
A short, precise report is more useful than a long explanation. Include:
- Artifact: email, SMS, website, search result, advertisement, or business-impersonation campaign.
- Identity: sender address, phone number, domain, display name, and the organization being copied.
- Location: complete URL, redirect chain if known, search query or result, and the service where you saw it.
- Timing: date, time, time zone, and whether the content is still live.
- Behavior: requested password, one-time code, payment, download, remote access, or personal information.
- Impact: whether you clicked, entered data, paid, lost access, or observed unauthorized activity.
- Attachments: original email or headers only when the recipient requests them; avoid forwarding malware to a general inbox.
Redact unrelated personal information from screenshots, but do not crop away the sender, URL, timestamp, or warning that proves what happened.
Understand what a report can and cannot do
Reporting creates intelligence and may improve filtering, warnings, investigations, or takedown decisions. It does not guarantee that a provider will contact you, remove a site, recover money, or identify the criminal. A phishing domain can disappear before review, change its hosting, or reappear under another address.
Use reporting alongside damage control. If an account, payment method, identity document, or work system is at risk, the organization that controls it is the urgent destination. Contacting that organization through a verified channel is faster than waiting for a platform or government form to produce a result.
Why reporting matters
Federal Trade Commission consumer guidance published in 2025 states that email was the top method scammers used to contact people in 2024. That figure describes the FTC’s US consumer reporting context; it is not a statistic for every country or every phishing campaign. Sending the original evidence to the appropriate service helps separate a one-off nuisance from a broader campaign and gives defenders the details needed to block similar messages.
Quick Recap
A safe sequence to remember
- Stop: do not click again, reply, call, or pay.
- Save: preserve the message, URL, sender or number, time, screenshots, and requested headers.
- Route: use APWG and the FTC for email, 7726 and the FTC for SMS, the mail provider for in-service reports, and the browser or search provider for fake sites.
- Verify: contact the impersonated organization through a known-good channel.
- Protect: change exposed passwords, enable MFA, secure payment accounts, and scan devices when appropriate.
- Escalate: use IdentityTheft.gov for identity exposure and IC3.gov, local law enforcement, or your organization’s incident team when loss or a continuing campaign warrants it.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
