How to Use the Phish Alert Button for Microsoft 365

Your organization may have recently installed the Phish Alert Button (PAB) in your mail client. Learn how this tool works and how you can use it to help keep your organization safe from malicious phishing emails.

When do I use it?
How do I use it?

• Microsoft 365
• Outlook mobile app (Android)
• Outlook mobile app (iOS)

Why should I use it?

When do I use it?

Click the PAB anytime you believe you have received a phishing email or any potentially dangerous email. Any emails you report using the PAB will be automatically deleted from your inbox. The emails you report will also be forwarded to a designated contact within your organization for analysis.

The PAB should only be used to report emails you believe to have malicious intent. If you are receiving spam or marketing emails, you should not use the PAB. You can delete these types of emails or add the sender or sender's email domain to a block list.

Back to top

How do I use it?

Depending on your device and email client, the steps for reporting an email using the PAB may vary. Below are PAB how-to steps for:

• Microsoft 365
• Outlook mobile app (Android)
• Outlook mobile app (iOS)

However, across all devices, the reported email will be handled the same. The email you report will be forwarded to an email address designated by your organization and then deleted from your inbox. If you report an email in error, you can retrieve the email from your Trash/Deleted Items.

Microsoft 365 (formerly Office 365)

Once the PAB add-in is installed, the PAB icon will appear in the drop-down menu of an open email.

To report an email as a phishing email:

1. Click the PAB icon.
2. A sidebar prompt will ask you if you are sure you want to report the email as a phishing email. Click the Phish Alert button to report the email.

   

Back to top

Outlook mobile app (Android)

To report an email as a phishing email:

1. On any open email, tap the three dots at the top-right of the screen.

   

2. The Phish Alert add-in will appear. Tap the Phish Alert add-in.

   

3. A prompt will ask you if you are sure you want to report the email as a phishing email. Tap the Mobile Phish Alert button to report the email.

    

4. If you have successfully reported a simulated phishing email sent on behalf of your organization, a congratulatory message will display. Click OK to close it.

   

Back to top

Outlook mobile app (iOS)

To report an email as a phishing email:

1. On any open email, tap the three dots at the top-right of the screen.

   

2. The Phish Alert add-in will appear. Tap the Phish Alert add-in.

   

3. A prompt will ask you if you are sure you want to report the email as a phishing email. Tap the Phish Alert button to report the email.

    

4. If you have successfully reported a simulated phishing email sent on behalf of your organization, a congratulatory message will display. Click OK to close it.

    

Back to top

Why should I use it?

Reporting emails will help your organization stay safer. Because the potential phishing emails you report are sent for analysis to your organization, your organization will now be aware of which phishing attacks are able to reach their employee inboxes. Once they're aware of possible vulnerabilities, they can better defend against them. You are an important part of the process of keeping your organization safe from cybercriminals. Stop, Look, and Think!

Back to top