How to stop phishing and scam emails

First: why blocking alone does not stop them

Blocking a sender stops one address. Scam emails come from new addresses all the time. Blocking helps with a shop that keeps writing. It hardly helps with scams.

What helps is everything that judges the email itself: the filter of your provider, your own reports, and a second filter. And a few habits that make a scam email harmless when it does arrive.

Step 1: Report phishing in your email program

A report is stronger than deleting. It tells your provider that the email was dangerous.

Step 2: Block what keeps coming back

If the same address writes again and again, block it.

• Gmail: open the email, click More next to Reply, then Block. Future emails from this sender go to Spam.
• Outlook.com: Settings, Mail, Junk email, then add the address under Blocked senders and domains.
• Yahoo Mail: Settings, More Settings, Security and Privacy, Blocked addresses. Yahoo allows up to 1,000 addresses.

Step 3: Do not answer, and do not “unsubscribe”

A reply shows the sender that somebody reads this address. The same goes for an “unsubscribe” link in an email you do not trust. Unsubscribe only from newsletters you really signed up for.

Step 4: Make a stolen password worthless

The US Federal Trade Commission names four protections against phishing:

• Use security software on your computer.
• Set your phone to update its software automatically.
• Use multi-factor authentication for your accounts. Then a stolen password alone is not enough.
• Back up your data.

And one habit: if an email asks you to sign in, do not use its link. Open the website yourself, the way you always do.

Step 5: Report it to the authorities

• United States: the FTC asks you to forward phishing emails to the Anti-Phishing Working Group at reportphishing@apwg.org and to report fraud at ReportFraud.ftc.gov.
• United Kingdom: the National Cyber Security Centre takes forwarded scam emails. The address is on its page Report a scam email. The NCSC says it acts on every message it receives.

Our sister site lists more places to report, including the companies that scammers imitate: How to report a phishing email.

Step 6: Add a second filter

The filter of your provider decides by its own rules, and some scam emails pass it. A second filter looks at the emails that arrive in your mailbox anyway.

Where a filter from outside fits in

Guard Mail is such a second filter. It works from outside, on the mailbox you already have.

1. Connect the mailboxOutlook and Hotmail through a Microsoft sign-in. Gmail, Yahoo, iCloud and others through an app password. The setup explains each step.
2. New emails are checkedA few minutes after an email arrives, Guard Mail checks it.
3. Scam emails are movedScam and phishing emails go into a folder called “Suspicious”. Spam goes to the spam folder. Everything else stays untouched.

Guard Mail itself never deletes an email. The “Suspicious” folder is never emptied automatically. Mail providers empty their own spam folder after a while, usually after around 30 days, so look into it now and then.

If you want, newsletters, advertising and notifications are moved into their own folders as well. You can also write your own rules in plain language. You keep your usual email program.

To check an email, its sender, subject and text are sent to our servers and to an AI model. The details are in the privacy policy.

Price: $6 a month or $60 a year for up to two mailboxes. Each further mailbox costs $2.50 a month. It is free to try.

Not sure about one email?

Paste it into the free check on our sister site. You get a plain answer in a few seconds: Is this a phishing email?

Questions and answers