Gmail already blocks most spam. The phishing that gets through is the well-written kind: AI now writes fluent, personal scam emails, so typos no longer give them away. These seven steps cover what you can do yourself, then what a tool can do for you. Updated November 10, 2026.
1. Report every phishing email
On a computer, open the email, click the three dots next to Reply and choose Report phishing. The message leaves your inbox and Gmail learns from the report. Use Report phishing, not Report spam, when the email tries to get a password, a payment or a code: it tells Gmail the message is dangerous, not just unwanted.
2. Block senders who come back
From the same three-dot menu, choose Block and the sender's name. Future mail from that address goes to Spam. This helps with one persistent sender, but phishing campaigns change addresses constantly, so blocking alone will not stop them.
3. Check Show original before you trust it
From the three-dot menu, choose Show original. Near the top, Gmail shows SPF, DKIM and DMARC results. A FAIL on a message that claims to be from your bank, PayPal or a delivery company is a strong warning sign. Our guide on how to verify an email sender walks through the other checks: the real address, the reply-to, the links and the attachments.
4. Never use the link or number in the email
If an email says your account is locked or a payment failed, open the site yourself from a bookmark or the app, or call a number you already have. Hover over a link (or press and hold on a phone) to see where it really goes. See phishing email examples for the stories scammers reuse most.
5. Lock down your Google Account
- Turn on 2-Step Verification, or sign in with a passkey, so a stolen password alone does not open your account.
- Turn on Enhanced Safe Browsing in your Google Account's security settings for stronger warnings about dangerous sites and downloads.
- Check Your devices in your Google Account and sign out of anything you do not recognize.
6. Do not lean on Gmail filters
Gmail filters work on fixed senders, words and domains. Phishing rotates all three, so a filter written for last week's scam misses this week's. Filters are still good for sorting mail you trust.
7. Add a scam check on every new email
A tool that checks every new email catches some of what Gmail's spam filter lets through, because it looks at what a scammer cannot fake rather than at how the email reads. Inbox Hero does this for Gmail:
| Check | What it looks at |
|---|---|
| Sender | SPF, DKIM and DMARC results, plus display-name and reply-to mismatches |
| Links | Matched on its own server against PhishTank and CERT Polska, two public lists of known phishing sites; also look-alike domains, raw IP addresses and buttons that show one site and go to another |
| Attachments | Programs disguised as documents (invoice.pdf.exe), macro Office files, attached sign-in pages and password-locked archives, judged by name and type and never opened |
| Intent | An AI review of anything suspicious for credential theft, fake invoices and gift-card, wire or crypto requests |
Clear threats move into an InboxHero/Fraud label, never deleted, and one tap brings a message back. It runs in the background, so you keep using Gmail as you do today. It is free for 14 days with no card, then 27¢ a day ($99 a year); if you do not add a card, a free plan keeps scam protection on one mailbox. Its daily totals are public on the live scam report.
Not sure about one email right now? Paste it into the free email check on the Inbox Hero home page: no sign-up, and nothing you paste is stored.
If you already clicked
Change your Google password from a page you open yourself, sign out of devices you do not recognize, turn on 2-Step Verification, and look in Gmail settings for forwarding addresses or filters you did not create: attackers add them to keep reading your mail. If a parent's account was taken over, follow our step-by-step recovery guide.
No filter catches everything. Treat any email that asks for money, a password or a code with care, even after it has been checked.
Frequently asked questions
How do I stop phishing emails in Gmail?
Report each one with Report phishing so Gmail learns from it, block repeat senders, check Show original on anything doubtful, turn on 2-Step Verification and Enhanced Safe Browsing in your Google Account, and add a scam check such as Inbox Hero that inspects every new email's sender, links and attachments and quarantines clear scams.
How do I report a phishing email in Gmail?
On a computer, open the email, click the three dots next to Reply and choose Report phishing. The message moves out of your inbox and Gmail uses the report to improve its filters.
Why does Gmail let phishing emails through?
Scammers now use AI to write fluent, personal emails, send from new domains and use real services to host their links, so some get past any single filter. A second check that looks at what a scammer cannot fake, such as a failed sender check or a link that goes somewhere other than it shows, catches some of what slips through. No filter catches everything.
Can I block phishing emails with a Gmail filter?
Only from a fixed sender or domain, and phishing campaigns change addresses constantly, so filters fall behind. Report phishing and blocking still help, but a tool that checks every new email does more of the work.
What should I do if I clicked a phishing link?
Change your Google password from a page you open yourself, sign out of devices you do not recognize in your Google Account, turn on 2-Step Verification, and check Gmail settings for forwarding rules or filters you did not create. If you entered card or bank details, call your bank.
Take back your inbox today
Connect Gmail or any mailbox in one click. Inbox Hero files the noise, drafts your replies, and quarantines phishing. It is free for 14 days, no card needed.
Start your 14-day free trial