If (when) anyone gets a bad actor email, i.e., a “phishing” scam trying to produce misdirection of funds and/or identity theft, those emails should be sent here:
reportphishing@apwg.com
and if it was sent from or arrived into a Microsoft mailbox, also here:
phish@office365.microsoft.com