Message or website feels wrong? Pause and verify through a trusted route.

For work messages, use the approved report button or security contact and follow instructions on preserving the message. Do not forward a live suspect attachment around the workplace or upload confidential mail to a public scanner. A report can send message contents to the reporting service; use your organisation’s process where privacy or sensitive records are involved.

For personal Outlook.com, Microsoft documents selecting the message then Report > Report phishing. Its guidance says reporting does not itself block that sender. For Gmail on a computer, follow its More > Report phishing instructions. Apps, account types and managed reporting controls can differ; follow the relevant provider’s current help if the control is absent.

Blocking an address may reduce mail from that address, but attackers can change senders or use compromised accounts. Do not block an entire business domain or create broad allow rules by guesswork. Check legitimate mail if a filter change catches something important. Do not use an unsubscribe link in a suspected scam to make it stop. If no details, files or access were exposed, finish the report/preservation process and stop interacting; if there was exposure, reporting alone is not recovery.

Stop further interaction and note what happened and when without revisiting the suspect page. Simply clicking does not prove a compromise, but it also does not prove there was none. Information can be captured while it is typed; do not assume it was safe because you did not press Submit. Report a work event to its responsible IT/security team promptly, including any approved login, app permission or remote session.

If money or bank/card details are involved, contact the bank or card provider immediately through a trusted route and ask how to protect the affected access or transactions. Do not send more money to a claimed safe account or pay someone promising recovery. Scamwatch’s response guidance also covers identity support and follow-up scams. Protecting access comes before completing a general scam report.

If a password, verification code or account approval was exposed, use a separate trusted device where the original may be unsafe, and go through the genuine account’s recovery/security process. Review affected access, sign-in sessions, recovery methods and app permissions with the provider or IT team; a password change alone may not revoke everything. Change reused passwords on other affected accounts through their genuine routes, retain recovery access and never approve an unexpected MFA prompt. If an attachment, download, extension or remote-access tool was opened or run, get device-response help too. Keep the scope clear rather than assume an antivirus scan covers the account.

For managed equipment, follow the responsible incident team’s containment instructions. For a personal device where malicious software or unauthorised remote control is suspected, stop sensitive use and seek trusted device-response help. Use an unaffected device for urgent bank/account contact. Do not let an unsolicited caller continue controlling the computer while you seek advice.

Record the app/file name and timing if safely available, but do not reopen the attachment or run it again to demonstrate the problem. Do not delete logs, factory-reset, reinstall everything or attach your only backup just to see whether the device looks normal. Appropriate containment and preservation depend on the event; tell the support team if backups or other devices were connected.

Official cybercrime-response guidance separates malware, account, identity and payment situations. Our malware-response guide offers a separate device path where appropriate. A scan cannot reverse stolen information or independently restore an account; retain a supported plan before returning to sensitive use.

Keep supported devices, browsers and mail apps updated and retain their phishing and malware warnings. Use strong unique passwords or supported passkeys, with appropriate MFA and private recovery methods. Set these up through the real service, never through an unexpected request to secure your account. Do not disable warnings to make a work task easier.

For a business, have the responsible administrator review the email protection, domain authentication, user reporting and web filtering appropriate to the actual service. They can reduce risk but cannot guarantee every harmful message, QR code, new site or compromised account is blocked. Do not copy a broad allow/block list from a generic guide.

Practise independent checks using harmless examples. Give staff a simple way to report uncertainty and verify changed instructions without pressure or blame. If an actual incident is underway, respond to it first; buying another filter is not recovery. For planned learning, our cyber security training can help people recognise requests and practise the agreed reporting process.

Get prompt help if you shared credentials/codes, approved access, sent money or identity records, opened a suspect file or let someone control a device. Contact the affected bank/service or workplace team through established channels. Preserve the event details privately. Use official reporting routes where appropriate after immediate protection; a scam report does not itself freeze an account or restore money.

If no exposure occurred but the request cannot be verified, leave it untouched and ask the legitimate organisation or responsible IT team. For recurring messages, agree a provider-specific filter/reporting review rather than repeatedly click, reply or install advertised protection. Do not share a full private message or token-bearing link in a public help thread.

Technical support can help assess the device/mail path and coordinate the next step, but cannot promise every account is safe, every scam blocked or money recovered. Keep the bank, account provider, identity support and organisation involved in the parts they control.