How to Use the Phish Alert Button for Microsoft 365

Your organization may have recently installed the Phish Alert Button (PAB) in your mail client. Learn how this tool works and how you can use it to help keep your organization safe from malicious phishing emails.

When Do I Use It?
How Do I Use It?

• Microsoft 365
• Outlook Mobile App (Android)
• Outlook Mobile App (iOS)

Why Should I Use It?

When Do I Use It?

You should click the PAB anytime you suspect that you have received a phishing email or any potentially dangerous email. The emails you report will also be forwarded to a designated contact within your organization for analysis.

The PAB should only be used to report emails you believe to have malicious intent. If you are receiving spam or marketing emails, you should not use the PAB. Spam or marketing emails can be deleted or you can add the sender, or sender's email domain, to a block list.

Back to Top

How Do I Use It?

Depending on your device and email client, the steps for reporting an email using the PAB may vary. However, the reported email will be automatically forwarded to your organization's designated contact regardless of the device and email client used. Below are PAB how-to steps for:

• Microsoft 365
• Outlook Mobile App (Android)
• Outlook Mobile App (iOS)

If you report an email in error, you can retrieve the email from your Trash/Deleted Items.

Microsoft 365 (formerly Office 365)

Once the PAB add-in is installed, the PAB icon will appear in the drop-down menu of an open email.

To report an email as a phishing email:

1. Click the PAB icon.

   

2. A sidebar prompt will ask you if you are sure you want to report the email as a phishing email. Click the Phish Alert button to report the email.

   

3. After clicking the Phish Alert button, you will be notified whether the phish was simulated or was malicious in nature.

   

Back to top

Outlook Mobile App (Android)

To report an email as a phishing email:

1. On any open email, tap the three dots at the top-right of the screen.

   

2. The Phish Alert add-in will appear. Tap the Phish Alert add-in.

   

3. A prompt will ask you if you are sure you want to report the email as a phishing email. Tap the Mobile Phish Alert button to report the email.

    

4. If you have successfully reported a simulated phishing email sent on behalf of your organization, a congratulatory message will display. Click OK to close it.

   

Back to top

Outlook Mobile App (iOS)

To report an email as a phishing email:

1. On any open email, tap the three dots at the top-right of the screen.

   

2. The Phish Alert add-in will appear. Tap the Phish Alert add-in.

   

3. A prompt will ask you if you are sure you want to report the email as a phishing email. Tap the Phish Alert button to report the email.

    

4. If you have successfully reported a simulated phishing email sent on behalf of your organization, a congratulatory message will display. Click OK to close it.

    

Back to top

Why Should I Use It?

Reporting emails will help your organization stay safer. The potential phishing emails you report are sent to your organization for analysis allowing for your organization to become aware of which phishing attacks are reaching their employee inboxes.

Once your organization is aware of possible vulnerabilities, they can better defend against them. You are an important part of the process of keeping your organization safe from cybercriminals. So remember to "Stop, Look, and Think!".

Back to top