Microsoft 365 - Report Suspicious message
Note: UW–Madison staff and students periodically receive malicious messages from @wisc.edu senders. If you’ve recently received an email to your @wisc.edu account and are unsure whether it’s real or a scam, you can check it against this table. If you are still unsure whether the message is legitimate, please contact the Help Desk.
Important:
-
Before you submit a message as spam/phishing, you should verify if the message is spam/phishing or if it is actually graymail or bulk mail. Do not use Report Suspicious to report gray or bulk mail. To manage bulk mail, review How to prevent receiving graymail documentation.
-
The recommended method for reporting spam/phishing messages via any Microsoft Outlook client is to use the "Report Suspicious" link as described below. Do not use "Report", "Junk" or "Mark as junk" actions/features in any email client as this process will create an automatic rule within your account to deliver future emails from this specific "From" address to your 'Junk Email' folder - because most spam senders change their "From" address frequently, this additional step is usually not an effective way to block spam. Furthermore, there is a limit to the number of addresses that can be added to your Blocked Senders at which point the Blocked Senders tool will no longer function.
- If you are reporting a message as suspicious on behalf of another account (an account you have full mailbox permissions to - say a service account), the report suspicious button/action will not work. You will need to follow steps outlined within the 'Non-Microsoft client' section below.
To report a spam/phishing message that was not delivered to your Junk Email folder (click on the plus sign to expand the specific client section)
Outlook on the web
- Log into your Office 365 account via Outlook on the web.
- Select/open the message you would like to report as suspicious
- Within the message window, click "Report Suspicious" button:
Note: If the "Report Suspicious" action button does not appear, follow these steps to add this action to your message ribbon:
-
At the top right corner within Outlook on the web, click the gear icon to open the Settings menu.
-
Click on View all Outlook settings.
-
In the Mail section, click on the Customize actions option.
-
Scroll down within the customize actions page and place a check mark next to "Report Suspicious" setting.
-
Click Save.
-
-
After a few seconds, the message will be processed and submitted to our system for analysis. It will also be moved to your "Deleted Items" folder. Click on Close button to complete the process.
Outlook for Windows/Mac desktop client
- Start Outlook.
- Select the message (preview pane enabled) or double-click to open in a new window.
- Within the "Message" tab/ribbon, click "Report Suspicious" button (you may need to click on the ... ellipsis to see this button)
-
Important: Do not use any other 'Report/Junk' action button other than the one above.
or 
- After a few seconds, the message will be processed and submitted to our system for analysis. It will also be moved to your "Deleted Items" folder. Click Close button to complete the process.
Outlook for Android/iOS
- Start Outlook.
- Open the message and click the three dots (ellipsis) located next to the from address.
- Within the sub-menu, scroll down and click "Report Suspicious" button.
- After a few seconds, the message will be processed and submitted to our system for analysis It will also be moved to your "Deleted Items" folder. Click Close button to complete the process.
Non-Microsoft client
To report a message that has been misclassified as spam/phishing manually
Outlook on the web (do not use Outlook desktop client)
- Go to Outlook on the web
- Find the message in question and use the Outlook on the web instructions to forward the message as an attachment to report-not-spam@doit.wisc.edu address.
- Move the message to your desired folder.
What if I submitted a message as spam/phish by mistake
If you mistakenly submit a message as spam/phish by mistake, do not be concerned - just move the message back to your desired folder from your "Deleted Items" folder.
When a message is submitted as spam/phish using the instructions outlined above, there are processes in place where the message will still be reviewed by our spam scanning vendor to validate if the message is truly spam/phishing. One false submission will not cause the message to be flagged as spam in the future.
If you used Microsoft's spam submission action (and not the steps above), the same results exist, except one additional action should be reviewed/reset - you should review your block list to remove the block filter that was created.