Phishing email in Gmail inbox? Kill it fast

EP
Erropedia Team
📅 June 20, 2026 📅 Updated Jul 31, 2026 👁 8 views Cybersecurity & Malware Beginner
A phishing email slipped past Gmail's spam filter. Here's how to trash it, report it, and lock down your account—starting with the easy fix.

You're reading this because a phishing email landed right in your inbox

I know that sinking feeling. You check your email, and there it is — a message from "PayPal" or "Microsoft" that looks real. But something's off. The grammar is weird, the link feels wrong. It slipped past Gmail's spam filter (or Outlook's, or Yahoo's). Don't panic. Here's the fix, from easy to thorough.

The 30-second fix: Delete and report

First, do not click anything. Not the link, not the attachment, not even "unsubscribe." Just delete it. But do it the right way.

  1. Open the email.
  2. Click the three dots (More) next to Reply.
  3. Select Report phishing. In Gmail, this trains Google's filter to catch similar junk next time. In Outlook, it's Report > Report phishing.
  4. Then hit the trash icon.

That's it. The email is gone. Google's filter learns. You move on. But if you already clicked something, keep reading.

The 5-minute fix: If you clicked a link or opened an attachment

Okay, so you tapped a link. Maybe you even typed your password into a fake login page. I've done it too — it happens. Here's the damage control.

  1. Change your password immediately. Go directly to the real website (type the URL yourself), not from the email. Use a strong password you haven't used anywhere else.
  2. Turn on two-factor authentication (2FA). Go to your account security settings. If it's not on, turn it on now. Use an authenticator app (Google Authenticator, Microsoft Authenticator) — not SMS if you can help it.
  3. Check for forwarding rules. Attackers sometimes set up email forwarding to steal more messages. In Gmail: Settings > See all settings > Forwarding and POP/IMAP. Look for any forwarding address you didn't set. Delete it.
  4. Sign out of all sessions. In Gmail, scroll to the bottom of your inbox, click Details next to "Last account activity." Then click Sign out all other web sessions. This boots any bad guys still inside.

This takes maybe 5 minutes. Once done, the immediate danger is gone. But if you want to be sure, go to the next step.

The 15-minute fix: Full security audit

You clicked the link, entered credentials, and now you want to be extra sure. Or maybe this happened at work and your IT guy is breathing down your neck. Here's the full cleanup.

  1. Run a malware scan. Even if you didn't download anything, some phishing sites can slip a keylogger or trojan onto your machine. Use Windows Defender (built-in, free, good enough) or Malwarebytes. Full scan. Takes 15-20 minutes.
  2. Check account recovery options. Attackers often change your recovery email or phone number to lock you out. In Gmail: Settings > Security > Recovery email and phone. Make sure they're yours.
  3. Review app permissions. Go to your Google Account > Security > Third-party apps with account access. Revoke anything you don't recognize. I once found a fake "Calendar Sync" app that was stealing contacts.
  4. Reset app passwords. If you use Gmail with Outlook or a phone mail app, generate new app-specific passwords. In Gmail: Settings > Security > App passwords. Delete old ones, create fresh ones.
  5. Monitor your accounts for a week. Watch for strange logins, password reset emails, or purchases you didn't make. Set up Google's Security Checkup (myaccount.google.com/security-checkup) to run every month.

That's it. The phishing email is gone, your account is locked down, and your anxiety should drop. You're good.

Why did this phishing email get through?

Spam filters aren't perfect. They miss things. A new phishing domain, a cleverly disguised link, or a hacked legitimate account can slip past. Google blocks 99.9% of spam, but that 0.1% still hits. This is why reporting helps — you're training the filter for next time.

If this keeps happening, consider switching to an email service with stronger phishing detection. Google Workspace (paid Gmail) has better AI for this. Outlook's built-in Defender also catches more. But for most people, the free version is fine if you stay watchful.

Quick tips to avoid future phishing

  • Hover over links before clicking. On desktop, mouse over the link. Does it match the sender's domain? If the email says "PayPal" but the link says "paypa1-login.com," it's fake.
  • Don't trust urgency. "Your account will be closed in 24 hours" is a classic trick. Real companies give you weeks, not hours.
  • Use a password manager. It won't auto-fill on a fake site because the domain doesn't match. That's a dead giveaway.
  • Enable 2FA everywhere. Even if they steal your password, they can't get in without the second factor.

I still get phishing emails on my personal Gmail. I delete, report, and move on. It's part of using the internet. But now you know how to handle it — fast, clean, and without drama.

Related Errors in Cybersecurity & Malware
0X80091001 Cryptic 0x80091001 Error? Here's the Fix SIEM alerts not correlating? Fix it in 3 steps Antivirus Deletes Game File: Fix False Positive Fast 0X80091006 CRYPT_E_AUTH_ATTR_MISSING (0x80091006) – The Fixes You Need
phishing email bypassed spam filter Gmail phishing fix phishing email reported mark email as phishing block sender Gmail Gmail spam filter not working phishing email clicked report phishing Google delete phishing email protect account phishing Gmail security check two factor authentication phishing Google Workspace phishing Outlook phishing email Yahoo phishing fix

Was this solution helpful?

EP
Erropedia Team
Tech Support Editors
The Erropedia editorial team researches and documents real-world tech errors from across Windows, Linux, macOS, networking, databases, cloud platforms, and more. Every solution is reviewed for accuracy and updated as software and systems evolve.