Help For employees
Report a suspicious email in Gmail
User guide for the PhishTrainer add-on for Gmail: report a suspicious email to your security team without leaving Gmail.
The PhishTrainer button icon in your mailbox
On this page
What the PhishTrainer add-on is for
The PhishTrainer add-on sends a suspicious email (phishing or spam) to your organization's security team, without leaving Gmail. Use it as soon as you receive an email that looks doubtful to you.
Before reporting: do not click any link, do not open any attachment, do not forward the email and do not reply to it.
Where to find the add-on
- Gmail on the web: open an email; the PhishTrainer icon is in the side panel on the right.
- Gmail on mobile: open an email; the add-on is at the bottom of the message.
The add-on texts are shown in the language of your Google account (French, German, English or Italian); for any other language, in English.
Reporting an email, step by step
- Open the suspicious email.
- Open the PhishTrainer add-on.
- For the question “What do you want to report?”, choose:
- Phishing: link, attachment, request for money or credentials.
- Spam: unsolicited advertising, no apparent danger.
- For the question “Did you interact with this email?”, tick what you did, otherwise leave blank:
- I clicked a link
- I opened an attachment
- I entered a password or personal information
- I replied or called the number given
- Click Send report. If you have not chosen Phishing or Spam, the add-on shows “Choose what you want to report.”: the boxes you ticked are kept.
After sending
The add-on shows PhishTrainer's response:
| Title | Text |
|---|---|
| Thank you | Your report has been sent. Thank you for your vigilance. |
| Already reported | You have already reported this email. Thank you for your vigilance. |
| Well done! | You didn't get caught: this email was a PhishTrainer phishing simulation. Thank you for your vigilance. |
- If the email was a simulation exercise organized by your company, the add-on indicates this, the first time you report it, with the label “Phishing simulation spotted”.
- If you ticked “I entered a password or personal information” or “I opened an attachment” for an email that is not a simulation, a “Do this right away” box is shown:
- “Change the password you entered and tell your IT department.”
- “Tell your IT department: the attachment you opened may have infected your computer.”
- Delete the email yourself. The add-on never deletes or moves the reported email; it shows “You can now delete this email.”
First use
- Google may ask you to authorize the add-on to read the open email. This permission is needed to report an email. You do not need any PhishTrainer account or password: you are identified by your Google account.
- If the add-on shows “Your organization is not yet linked to PhishTrainer. Enter the activation code provided by your administrator.”, enter the code received from your IT department in the Activation code field, then click Activate. Your Google account is then recognized with nothing more to enter.
Possible messages and what to do
| Message shown | What to do |
|---|---|
| “Select an email to be able to report it.” | Open the email to report, then open the add-on again. |
| “Email too large” | PhishTrainer accepts emails up to 10 MB, including attachments. Forward the email to your IT department so that they can analyze it. |
| “PhishTrainer needs permission to read the open email in order to report it. Grant it, or forward this message to your IT department.” | Grant the permission requested by Google, or forward this message to your IT department. |
| “Activation code rejected. Check it with your administrator.” | Check the code with your IT department. |
| “The report could not be sent” | Check your connection, then click Try again. If the problem persists, contact your IT department. |
| “Too many requests in a short time” | Try again in a few minutes. |
| “The reporting service is disabled for your organization…” | Contact your IT department. |
| “Your access has been removed…” | Contact your IT department. |
| “The report cannot be recorded at the moment…” | Contact your IT department. |
Privacy
The reported email is sent in full, including attachments, to PhishTrainer for analysis by your organization's security team. It is only read when you click Send report. The About button, at the bottom of the add-on, repeats this information.
Didn’t find the answer? Contact us