Report a scam email: 2026 guide
From spotting it to taking it down: five steps to report scam emails and get the phishing site taken offline.
Report a scam email in 5 steps
Recognize a scam email
Typical signs: impersonal greeting, urgency ('your account will be suspended'), spelling mistakes, spoofed sender domain, shortened or masked links. If in doubt, don't click.
Save the original email
Export it as .eml (Outlook: 'Save as': Gmail: 'Show original' → download). This is the only way to preserve headers and authentication results for analysis.
Check the sender's domain
Run a WHOIS lookup on the sender's domain. Recently registered domains (under 30 days old) are typical of scam emails. Blackwall performs this check automatically when you submit a report.
Report to Blackwall + BSI + Verbraucherzentrale
Submit the URL to Blackwall (takedown), the .eml to phishing@bsi.bund.de (analysis), and the .eml to phishing@verbraucherzentrale.nrw (warning). Three channels, three different layers: reporting to all of them works fastest.
Secure your bank accounts & passwords
If you clicked a link or entered data: change the passwords of any reused accounts, notify your bank, block your cards, and enable MFA.
Where you can report scam emails
Each channel works on a different level: combining them is most effective.
BlackwallTakedown
Submits the URL from the email to the host and registrar. The linked phishing site typically goes offline within 2-24 hours.
Report to BlackwallBSI Bürger-CERTAnalysis
phishing@bsi.bund.de: Germany's federal cybersecurity agency, for national analysis and early warnings. Always forward it as a .eml attachment.
bsi.bund.deVerbraucherzentrale NRWWarning
phishing@verbraucherzentrale.nrw: the Phishing Radar warns consumers weekly about new scam tactics.
verbraucherzentrale.nrwYour email provider
Gmail, Outlook, GMX, Web.de: 'Report as phishing' improves filters for millions of other users. Not a substitute for a takedown.
Frequently asked questions about scam emails
Report the scam email now
One form, three channels. Blackwall coordinates with the host, the BSI, and the Verbraucherzentrale: you just need the URL.
