Spot and Report a Phishing Email Impersonating an AI Company

Updated 8 November 2026 · Standard formula, shown below

This guide helps you recognize an email pretending to come from an AI company, avoid exposing your account or device, and report it through a safe channel. Before you begin, do not click links, open unexpected attachments, reply, or use contact details supplied in the suspicious message.

What You’ll Need

Access to the email account or app where the message arrived.
The provider’s built-in report-phishing or spam option, if available.
A way to reach the organization using a website address, app, or support contact you already know is genuine.
If this is a work or school account, your organization’s IT or security reporting process.

Step-by-Step

Pause and avoid interacting. Do not click a button, follow a sign-in link, scan a QR code, download a file, enable macros, or call a phone number in the email. Do not reply, even to ask whether it is genuine. Interacting can expose credentials, install unwanted software, or confirm that your address is active. If the email claims there is an urgent account problem, verify it separately rather than acting on the message.
Check whether you expected the message. Think about whether you recently created an account, requested a password reset, made a purchase, or contacted support. An unexpected message is not automatically fake, but urgent claims about account closure, billing, refunds, model access, API keys, or security incidents deserve careful checking. Do not let a deadline pressure you into bypassing normal verification.
Inspect the sender address, not just the display name. Expand the sender details in your mail app and examine the full address after the @ sign. A familiar company name or logo can be displayed alongside an unrelated address. Look for misspellings, extra words, unusual subdomains, or a domain that only resembles the organization’s real one. A sender address can also be spoofed, so a seemingly correct address does not prove authenticity.
Examine links without opening them. On a computer, hover over a link or button and read the destination shown by your mail app. On a phone, use the app’s safe link-preview feature if available; do not tap through to inspect it. Watch for misspellings, lookalike characters, unexpected URL shorteners, and domains unrelated to the organization. The visible link text can differ from its actual destination. Do not enter credentials or payment information on a page reached from a suspicious message.
Look for warning signs in the wording and request. Common clues include unusual grammar, generic greetings, an unexpected attachment, pressure to act immediately, requests for passwords or one-time codes, and demands to pay through an unfamiliar method. Treat requests for API keys, recovery codes, or secret project information as sensitive. Polished writing and accurate personal details do not establish that an email is legitimate.
Verify the claim through a separate route. Open the company’s official app or type a web address you already know into your browser. Check your account notifications or contact support using details found independently, not by clicking the email’s links or calling its number. If the message is about a work account, confirm through your organization’s established IT channel. If you cannot verify the claim, leave the link and attachment unopened and report the message.
Report the email using your mail service’s controls. Use the message menu or toolbar option labeled “Report phishing,” “Report spam,” or similar. Choose phishing when that specific option exists. Reporting through the mail service helps its filtering systems; simply deleting the email does not provide the same report. If it is a work or school account, also forward or submit it according to the security team’s instructions. Some organizations request a phishing-report button or a forwarded message—follow their procedure rather than guessing.
Preserve details only if a security team needs them. If you are asked to provide evidence, use the organization’s approved method. A security team may need the original message with its full headers to investigate sender routing, but do not post the message publicly or send it to an unverified address. If you do not know how to show full headers, ask the provider or IT team for instructions. Avoid forwarding the email casually, since forwarding can remove useful information or expose other recipients.
Delete or quarantine it after reporting. Follow your provider’s or workplace’s instructions. If no investigation is needed, remove it from the inbox and empty it from deleted items only if that is your normal process. Do not delete a message that your security team has asked you to preserve. If the message appears in several accounts, report each copy through the relevant account’s reporting controls.
Act promptly if you already interacted. If you entered a password, visit the genuine service by typing its address yourself and change that password immediately. If you reused it elsewhere, change it on those accounts too, starting with important accounts that share the credential. Turn on multifactor authentication where available, review active sessions and account activity, and sign out unknown sessions. If you disclosed a one-time code, API key, or recovery code, contact the genuine provider or your organization’s security team right away and ask how to revoke or replace it. If you downloaded or opened a file, stop using it and contact IT or a trusted device-support professional; do not run further files or instructions from the email.

Common Mistakes

Trusting logos or the display name: These are easy to copy. Check the full address and verify independently.
Assuming a correct-looking sender proves it is genuine: Sender information can be forged. Assess the message and confirm important requests through a separate route.
Clicking to “check” a link: A link may lead to a credential-stealing page even if the page looks familiar. Inspect without opening and use the official app or known address instead.
Replying or forwarding it widely: Replies can confirm your address is active, while casual forwarding can spread the threat or lose useful evidence. Use reporting tools and approved security channels.
Only deleting the message: Deletion protects your inbox but may not alert the email provider or your security team. Report it first when possible.

Tips

Use a password manager to help identify when a sign-in page is on the wrong domain; never override a warning to make a password autofill.
Turn on multifactor authentication for important accounts, and never share a one-time login code with someone who contacts you by email.
Bookmark or use the official app for services you access often, rather than relying on emailed sign-in buttons.
Keep your email app, browser, and device updated, and make sure you know how to report a message before an urgent one arrives.
When in doubt, report the message and verify the claim independently. Reporting a suspicious email is safer than trying to prove it by interacting with it.

Troubleshooting

I can’t find a phishing-report option. Open the message’s more-options menu or check the mail service’s help instructions. If the service only offers spam reporting, use that. For work or school email, follow the organization’s security policy or contact IT through a known channel.

I clicked a link but did not enter information. Close the page without downloading anything or granting permissions. Do not return through the email. If a file downloaded automatically, do not open it; contact your IT team if this is a managed device or you see unexpected behavior.

I entered my password or a code. Go directly to the genuine service, change the password, and review account sessions and activity. Change reused passwords elsewhere. Contact the provider or your organization’s security team if you cannot sign in, see unfamiliar changes, or disclosed a code or key.

I’m unsure whether the message is actually phishing. Do not act on it while uncertain. Check for a matching notice inside the genuine service, or ask support or IT using contact information obtained independently. Reporting a suspicious message does not require you to click its links.

I already deleted it. Check the trash or deleted-items folder if you need to report or preserve it. If your provider has removed it permanently, tell your security team what you remember, including the sender, subject, time received, and any action you took.

Frequently Asked Questions

Can an email from a real-looking company address still be phishing?
Yes. Sender details can be spoofed, and a lookalike domain may appear convincing. Verify important requests through the company’s official app, known website, or independently sourced support contact.

Should I open an attachment to see whether it is safe?
No. Do not open an unexpected attachment to inspect it. Report the email and ask your security team or provider for guidance if the file may be relevant.

Is it safe to forward a phishing email?
Only when your provider or security team specifically asks you to, and use its approved method. Forwarding can remove technical details or expose recipients; a built-in report option is usually preferable.

What if I only replied to the email?
Stop responding and do not share more information. Report it, watch for follow-up messages, and contact your security team if you disclosed sensitive details or the account is managed by work or school.

Does reporting guarantee the email will be blocked?
No. Reporting helps the mail service or security team assess the message, but it cannot guarantee that every copy or similar message will be stopped. Continue checking suspicious messages carefully.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.