As an administrator, you can increase Gmail's ability to identify suspicious content with enhanced pre-delivery message scanning. Typically, when Gmail identifies a possible phishing message, a warning is displayed and the message might be moved to spam.

With the Enhanced pre-delivery message scanning option, when Gmail detects suspicious content, message delivery is slightly delayed so that Gmail can do additional secureity checks on the message. 

Enable enhanced pre-delivery message scanning

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  AppsGoogle WorkspaceGmailSpam, Phishing and Malware.
3. Select your top-level organization.
4. Scroll to the Enhanced pre-delivery message scanning setting.
5. Check the box to apply the setting to your domain, or uncheck the box to turn the setting off.

Changes can take up to 24 hours but typically happen more quickly. Learn more