How Do I Report a Scam Email: A Step-by-Step Guide

You got a suspicious email. Here is how to spot it, where to send it, and what to do after.

A strange email lands in your inbox. It looks like it is from your bank, or a store you use, or even the government. Something feels off. You want to report it, but where do you even start? This guide walks you through it, step by step.

What counts as a scam email

The FBI calls these phishing emails. They are messages designed to get your personally identifiable information or financial credentials. That means your passwords, your Social Security number, or your bank account details.

Scammers often use spoofing techniques to lure you in, the FBI says. The email looks like it came from someone you trust. But it did not.

Why do they do it? The FBI says scammers typically pose as a creditor, bank, or state benefits agency. They want you to take the bait. The FTC says they want to trick you into giving them your personal information.

How to spot a scam email before you report it

Before you report anything, look closely at the message. Here are the signs the FBI and PayPal tell you to check.

Check the sender's address. The FBI says scammers use slight differences in email addresses, URLs, and spelling to trick your eye and gain your trust.

Look for typos and bad grammar. PayPal says typos, misspellings, and incorrect grammar are common in phishing messages.

Be careful with attachments. PayPal says attachments can contain malware, so you should never open them unless you are completely sure they are legitimate. The FBI says not to open an email attachment from anyone you don't know.

Do not click anything. The FBI says not to click on anything in an unsolicited email or text message. Links in these emails often lead to fake websites. The FBI says fake websites used in phishing are made solely to steal your information.

Check the greeting. PayPal says real PayPal messages always use the full name listed in your PayPal account. A generic "Dear Customer" is a red flag.

Do not trust the padlock. PayPal says the letter s in https does not always mean a site is legitimate because hackers can build encrypted sites too. PayPal also says many fake sites show a padlock symbol in the address bar, so you should not rely on it.

Where to report a scam email

Now you know it is a scam. Here is where to send it.

Report it to the FBI. The FBI says to report spoofing and phishing to its Internet Crime Complaint Center at ic3.gov.

Report it to the FTC. The FTC's guide says to report a scammer at ReportFraud.ftc.gov. The FTC can use scam reports to bring cases against scammers. It can also use them to teach people about scams and to share data about what is going on in your community.

Report FTC impersonation scams. The FTC says to report FTC impersonation scams at ReportFraud.ftc.gov. If the email pretends to be from the FTC itself, send it there.

Not sure which agency handles it? USAGov's scams and fraud page says you can answer a few questions to learn which government agency can help with a scam. You can also answer a few questions to learn how to report a scam to the right place.

What happens after you report

Will reporting a scam email stop the scammer? Maybe not right away. But your report matters.

The FTC says it can use scam reports to bring cases against scammers.

So do not skip reporting because you think one email is too small. It is not.

How to protect yourself from future scam emails

Reporting is one step. Here is how to make yourself a tougher mark.

Set up two-factor authentication. The FBI says to set up two-factor or multi-factor authentication on any account that allows it and never disable it. This adds a second lock on your accounts.

Verify requests on your own. The FBI says to look up a company's phone number on your own and call the company to ask if a request is legitimate. Never use the number in the email.

Remember what companies will not do. The FBI says companies generally do not contact you to ask for your username or password. An email asking for those is a warning sign.

Never send info through email. PayPal says you should never give personal, credit card, or account info through email, text, or phone.

Detect, avoid, and report. PayPal says the best plan to stay secure is to detect, avoid, and report.

Scam emails come in many flavors. Here are a few related tricks to know about.

Some scam emails pretend to be from PayPal. Learn more about the email scam PayPal and how it works. If you fell for one and need to report it, see our guide to the PayPal fraud report process.

Scam emails often link to fake websites. If you clicked a link and landed on a suspicious site, learn how do I report a scam website.

Payment apps are another common target.

If the email pretends to be from a company you use

This one trips people up. The email names your bank. It shows the right logo. Maybe it even knows your name.

Do not let that fool you. PayPal says an authentic PayPal email shows the company logo and a checkmark in your email inbox view. Many email providers like Apple, Gmail, and Yahoo support companies using their logo to help consumers identify real messages.

PayPal also says scammers can easily fake a Caller ID, so a call that says PayPal is not necessarily from PayPal.

If you think the email really is from a company you use, do not reply to it. The FBI says to look up a company's phone number on your own and call the company to ask if a request is legitimate. PayPal says to contact PayPal only through the Contact page in the Help Center or by calling PayPal Customer Service.