If you get a phishing or any other form of scam email in the UK, there are a number of bodies you can report it to. To bring it to the attention to authorities, you can forward it to the National Cyber Security Centre (SCSC). You can also alert your email provider and often the company that’s being impersonated.
This guide details how all the most common ways to report a scam email.
The Short Version
- Forward it to the NCSC
- Notify Action Fraud If you’ve been the victim of a crime
- Flag it as a phishing email
- Notify the company being impersonated
Save 81% on a VPN with SurfShark
Surfshark has dropped the price of its VPN to £1.94 a month. Head over to Surfshark now to pay a one time price of £46.44 for 24 months of Surfshark and save 81%.
- Surfshark
- 81% off
- £1.94 a month
Step
1Forward it to the NCSC
The National Cyber Security Centre invites UK internet users to forward any phishing emails they receive to report@phishing.gov.uk. You can alternatively take a screenshot of a suspicious email and send it to the same address. Even if you’re not certain that the email in question is a scam, they’d like to see it. The NCSC cannot let you know what action has been taken about anything you forward, but it will analyse and act on everything you send. This is a key way you can help the agency shut down dangerous sites, which are often linked to in scam messages.
Step
2Notify Action Fraud if you’ve been the victim of a crime
If a scam email has led to you, your business, or someone close to you losing money, it is a crime and should be reported to Action Fraud, the UK’s Nation Fraud and Cyber Crime reporting centre. To report a cybercrime, go to https://www.actionfraud.police.uk/ and select your status from the Start reporting box. If you wish to be informed of any action taken about your case, you’ll have to create an account.
Step
3Flag it as a phishing email with your mail provider
Web-based email providers, including Gmail, ProtonMail, and Outlook provide integrated tools for detecting and reporting phishing emails. To report a suspicious message in Gmail, open the email, click on the three-dots icon at the top right, select Report phishing, then click Report Phishing Message in the box that appears. The process is similar in other webmail services.
If you have an IMAP/POP3 account, for example from your ISP, they’ll probably have a dedicated phishing reporting address that you can find in their documentation. For example, BT’s security help pages request you to forward phishing emails to them at abuse@bt.com – once again, the company says it will act on all emails, but will probably not reply.Step
4Notify the organisation being impersonated
Many companies invite users to contact them if anyone is attempting to impersonate them for fraudulent reasons, such as phishing emails. While this feature lacks the scope to include a comprehensive list, see the FAQ below for a selection of useful company fraud reporting contact details.
Save 81% on a VPN with SurfShark
Surfshark has dropped the price of its VPN to £1.94 a month. Head over to Surfshark now to pay a one time price of £46.44 for 24 months of Surfshark and save 81%.
- Surfshark
- 81% off
- £1.94 a month
FAQs
Send spam emails purporting to be from Amazon to stop-spoofing@amazon.com as attachments or forwards. Go to https://www.amazon.co.uk/gp/help/customer/display.html%3FnodeId%3DGRGRY7AQ3LMPXVCV for more information.
If you receive an email pretending to be from Apple, forward it to reportphishing@apple.com. See https://support.apple.com/en-gb/HT204759 for more information.
A real eBay message will also be available on the site itself in your Messages inbox. If you get an email purporting to be from eBay, forward it to spoof@ebay.co.uk. Find more information, including examples of common signs that you’re being phished at https://www.ebay.co.uk/help/account/protecting-account/recognising-phishing-phone-calls-emails?id=4195.
Suspicious emails purporting to be from Facebook can be forwarded to phish@fb.com. Go to https://www.facebook.com/help/phishing for more information on identifying phishing emails and securing your account in the wake of an attempt.
PayPal encourages those who’ve received suspicious messages purporting to be from it to forward them directly to spoof@paypal.com. For more information, see https://www.paypal.com/bm/webapps/mpp/security/report-problem.
We’ve already covered flagging suspicious mails up in Gmail, but Google has a wide range of other services, which scammers often impersonate. See Google’s scam avoidance and reporting page at https://support.google.com/faqs/answer/2952493 for more information on all of them.
You can also get phishing sites added to Google’s Safe Browsing tools, which will automatically alert Chrome and Google service users who try to visit them, by reporting their URL at https://safebrowsing.google.com/safebrowsing/report_phish/.
You might like…
Editorial independence
Editorial independence means being able to give an unbiased verdict about a product or company, with the avoidance of conflicts of interest. To ensure this is possible, every member of the editorial staff follows a clear code of conduct.
Professional conduct
We also expect our journalists to follow clear ethical standards in their work. Our staff members must strive for honesty and accuracy in everything they do. We follow the IPSO Editors’ code of practice to underpin these standards.
Editorial independence
Editorial independence means being able to give an unbiased verdict about a product or company, with the avoidance of conflicts of interest. To ensure this is possible, every member of the editorial staff follows a clear code of conduct.
Professional conduct
We also expect our journalists to follow clear ethical standards in their work. Our staff members must strive for honesty and accuracy in everything they do. We follow the IPSO Editors’ code of practice to underpin these standards.