What should you do if you receive a phishing email? (2023)

If you get a phishing email, it can be a little scary. Fortunately, nothing infects your computer if you don't click on any links or respond. Here's What To Do (and What To Do)nodo) if you receive a phishing email.

In a phishing email, the sendertry to get you to click on a linkor provide personal information, such as bank details or passwords. are a conventionalsocial engineering attack. We explain in detailhow phishing emails work, which are worth reading if you're not familiar with them or don't know how to spot one.

But what should you do if you receive a phishing email?

Don't panic and don't click on any links

When you receive a suspicious phishing email, don't panic. Modern email clients like Outlook, Gmail and Apple Mail do an excellent job of filtering emails that contain malicious attachments or code. Just because a phishing email lands in your inbox doesn't mean your computer is infected with a virus or malware.

Esperfectly safe to open an email(and use the preview pane). Email clients don't allow code to run when you open (or view) an email for a decade or more.

However, phishing emails are a real security risk. It shouldNeverclick a link in an email or open a file attached to one, unless you are 100% sure you know and trust the sender. You should also never reply to the sender, even to tell them not to send you any more emails.

Phishers can send emails to thousands of addresses every day, and if you reply to one of their messages, it confirms that your email address is active. That makes you even more of a target. Once the phisher knows you're reading his emails, he'll send more attempts and wait for one of them to work.

So, to be clear:Do not click on any links, do not open any attachments and do not respond.

RELATED: Why You Can't Get Infected Just by Opening an Email (Further)

check with sender

If a suspicious email appears to be from someone you know or a company you use, check with them to make sure the message is legitimate.To donoreply to the email. If it appears to be from someone you know, create a new email, text or call the person and ask if they sent you the email. Do not forward the email as this only propagates the potential phishing attack.

If the email claims to be from a company you use, such as your bank, gym, medical institution, or online retailer, go to their website and contact them there. Again,to do noclick any link in the email. Enter the website address yourself (or use your preferred search engine) and use your contact options to ask the company if they sent it to you.

If the email appears to have been sent to a lot of people, such as a communication about an app update, you can also tweet the company at their official address and ask them directly. The rep won't know the individual emails, but he will know if the company has sent a communication to all customers.

RELATED: What is Typosquatting and How Do Scammers Use It?

inform email

There are four types of organizations you can report phishing emails to:

• Your company
• Your email provider
• A government body
• The organization the email must come from

Report to your company

If you receive a phishing email at your work address, follow your company policy instead of doing anything else. Your IT security policies may require you to forward a phishing email to a specific address, fill out an online report, file a ticket, or simply delete it.

If you're not sure what your company's policy is, ask your IT security team. We recommend that you discoverbeforereceive a phishing email if possible. It's better to prepare and be ready.

Notify your email provider

Your email provider likely has a process you can follow to report phishing emails. The mechanism varies from provider to provider, but the reason is the same. The more data the company has on phishing emails, the better spam/junk filters can do to stop scams from reaching you.

If Google or Microsoft provide your email account, they have a built-in reporting mechanism for their customers.

On Google, click the three dots next to the Reply to email option and select "Report Phishing".

A panel opens and asks you to confirm that you want to report the email. Click "Report Phishing Email" and Google analyzes the email.

The Outlook client does not provide an option to report an email to Microsoft, but theOutlook Web Apphe does. It works the same way as Gmail. Click the three dots next to the Reply to email option and select "Mark as phishing".

This opens a panel to confirm that you want to report the email. Click "Report" and then Microsoft reviews the email.

You cannot report a phishing email directly in the Apple Mail client. Instead, Apple asks that you forward the message toreportphishing@apple.com.

For any other email provider, look online to see how it reports phishing emails to them.

Report to a government agency

Some countries have agencies that deal with phishing emails. In the US, the Cybersecurity and Infrastructure Security Agency (a branch of the Department of Homeland Security)ask you to forward the emailaphishing-report@us-cert.gov. In the UK, you can report mail tofraudulent action, o National Cybercrime and Fraud Reporting Center.

In other countries, a quick search should tell you if and how you can report a phishing email to the authorities.

If you report a phishing email to your ISP or a government agency, don't expect a response. Instead, email providers and government agencies use the information you submit to try to prevent accounts from sending emails. This includes blocking senders (or adding them to spam/junk filters), shutting down their websites, or even prosecuting them if they violate any laws.

By reporting phishing emails, you help everyone by helping authorities block as many of them as possible. As more people report phishing emails, more agencies and vendors can prevent senders from sending them.

Inform the company that allegedly sent the email

If the phishing email is from a company, you can often report it directly to that company. For example, Amazon hasa dedicated email address and formto report phishing by email and by phone.

Most companies and government agencies (especially those dealing with financial or medical businesses) have ways to report phishing. If you search for "[company name] phishing report", you can find it quickly.

Mark sender as junk or spam

You probably don't want to receive any more email from the person who sent it. Mark it as spam or junk mail and your email client will block any further email from that address. We cover how to do this in ourguia do gmailythis article in Outlook.

You can add senders to a spam/junk list in any email client. If you use something other than Gmail or Outlook, consult your company's documentation to learn how to mark a message as spam.

delete email

Finally, delete the email. This usually sends it to the trash or deleted items folder, so be sure to delete it there as well. It is not necessary to save it after reporting it.

You don't need to run a virus scan or clear your browser history just because you received a phishing email. However, you must run an antivirus program (we likeMalwarebytes para Windows e Mac), and it doesn't hurtscan from time to time.

If you run a regularly updated antivirus program, it should catch anything malicious before it runs. Also, if you don't click on a link or open an attachment in the email, it's unlikely you've downloaded something malicious onto your system.

Don't worry and carry on

Phishing emails are annoyingly common. Fortunately, your spam or junk mail filters catch them most of the time and you never see them. Sometimes they don't even get that far because the provider stops them. To defeat the few that make it through, just be careful and don't click on any links or attachments unless you're sure they're safe.

RELATED: Why do they write phishing with 'ph?' an unlikely tribute

Millions of phishing emails are sent every day, so don't worry, you're not normally a target. Just follow the easy steps we covered above and get on with your day.