How to report phishing emails in Outlook (including to the NCSC)

Last updated: 27 September 2026

If you receive a suspicious email in Microsoft 365, report it rather than just deleting it. This helps Microsoft’s filters and your IT team protect everyone else.

Use the built-in Report button in Outlook

Outlook now has a built-in Report button on all versions, including Outlook for Windows, Mac, web and mobile. Microsoft has put its older Report Message and Report Phishing add-ins into maintenance mode and recommends switching to the built-in button.

1. Select the suspicious email.
2. Click Report (on the Home ribbon, or the three-dot menu on mobile and web).
3. Choose Report phishing or Report junk.

Send reports to the NCSC too

The National Cyber Security Centre’s Suspicious Email Reporting Service (SERS) takes down malicious websites and scam senders. Anyone can forward a suspicious email to report@phishing.gov.uk.

For administrators

In the Microsoft Defender portal, go to Settings > Email & collaboration > User reported settings. There you can choose whether reports go to Microsoft, to a reporting mailbox for your IT team, or both, and customise the messages users see. If you still use the old add-ins, remove them once the built-in button is set up.

Learn more about our cyber security services and staff awareness training.