diff --git a/website/client/components/chat/chatCard.vue b/website/client/components/chat/chatCard.vue
index 138a534f55..2ccf80fa99 100644
--- a/website/client/components/chat/chatCard.vue
+++ b/website/client/components/chat/chatCard.vue
@@ -27,7 +27,6 @@ div
         span.action(v-if='(inbox || (user.flags.communityGuidelinesAccepted && msg.uuid !== "system")) && !isMessageReported', @click='report(msg)')
           .svg-icon(v-html="icons.report", v-once)
           span(v-once) {{$t('report')}}
-          // @TODO make flagging/reporting work in the inbox. NOTE: it must work even if the communityGuidelines are not accepted and it MUST work for messages that you have SENT as well as received. -- Alys
         span.action(v-if='msg.uuid === user._id || inbox || user.contributor.admin', @click='remove()')
           .svg-icon(v-html="icons.delete", v-once)
           span(v-once) {{$t('delete')}}
@@ -238,7 +237,7 @@ export default {
       return achievementsLib.getContribText(message.contributor, message.backer) || '';
     },
     isMessageReported () {
-      return this.msg.reported || this.reported;
+      return this.msg.flags && this.msg.flags[this.user.id] || this.reported;
     },
   },
   methods: {
diff --git a/website/server/controllers/api-v4/members.js b/website/server/controllers/api-v4/members.js
new file mode 100644
index 0000000000..2bf8db0341
--- /dev/null
+++ b/website/server/controllers/api-v4/members.js
@@ -0,0 +1,42 @@
+import { authWithHeaders } from '../../middlewares/auth';
+import { chatReporterFactory } from '../../libs/chatReporting/chatReporterFactory';
+
+let api = {};
+
+/**
+ * @api {post} /api/v4/members/flag-private-message/:messageId Flag a private message
+ * @apiDescription A message will be hidden immediately if a moderator flags the message. An email is sent to the moderators about every flagged message.
+ * @apiName FlagPrivateMessage
+ * @apiGroup Member
+ *
+ * @apiParam (Path) {UUID} messageId The private message id
+ *
+ * @apiSuccess {Object} data The flagged chat message
+ * @apiSuccess {UUID} data.id The id of the message
+ * @apiSuccess {String} data.text The text of the message
+ * @apiSuccess {Number} data.timestamp The timestamp of the message in milliseconds
+ * @apiSuccess {Object} data.likes The likes of the message
+ * @apiSuccess {Object} data.flags The flags of the message
+ * @apiSuccess {Number} data.flagCount The number of flags the message has
+ * @apiSuccess {UUID} data.uuid The user id of the author of the message
+ * @apiSuccess {String} data.user The username of the author of the message
+ *
+ * @apiUse MessageNotFound
+ * @apiUse MessageIdRequired
+ * @apiError (404) {NotFound} messageGroupChatFlagAlreadyReported The message has already been flagged
+ */
+api.flagPrivateMessage = {
+  method: 'POST',
+  url: '/members/flag-private-message/:messageId',
+  middlewares: [authWithHeaders()],
+  async handler (req, res) {
+    const chatReporter = chatReporterFactory('Inbox', req, res);
+    const message = await chatReporter.flag();
+    res.respond(200, {
+      ok: true,
+      message,
+    });
+  },
+};
+
+module.exports = api;
diff --git a/website/server/libs/chatReporting/inboxChatReporter.js b/website/server/libs/chatReporting/inboxChatReporter.js
index de111fdd2b..e236f705b7 100644
--- a/website/server/libs/chatReporting/inboxChatReporter.js
+++ b/website/server/libs/chatReporting/inboxChatReporter.js
@@ -10,6 +10,7 @@ import slack from '../slack';
 import apiError from '../apiError';
 
 import _find from 'lodash/find';
+import * as inboxLib from '../inbox';
 
 const FLAG_REPORT_EMAILS = nconf.get('FLAG_REPORT_EMAIL').split(',').map((email) => {
   return { email, canSend: true };
@@ -33,7 +34,7 @@ export default class InboxChatReporter extends ChatReporter {
       this.inboxUser = await User.findOne({_id: this.req.query.userId});
     }
 
-    let messages = this.inboxUser.inbox.messages;
+    const messages = await inboxLib.getUserInbox(this.inboxUser);
 
     const message = _find(messages, (m) => m.id === this.req.params.messageId);
     if (!message) throw new NotFound(this.res.t('messageGroupChatNotFound'));
@@ -70,10 +71,7 @@ export default class InboxChatReporter extends ChatReporter {
   updateMessageAndSave (message, updateFunc) {
     updateFunc(message);
 
-    this.inboxUser.inbox.messages[message.id] = message;
-    this.inboxUser.markModified('inbox.messages');
-
-    return this.inboxUser.save();
+    return inboxLib.updateMessage(message);
   }
 
   flagInboxMessage (message) {
diff --git a/website/server/libs/inbox/index.js b/website/server/libs/inbox/index.js
index 5f5fd76658..f4ab57686a 100644
--- a/website/server/libs/inbox/index.js
+++ b/website/server/libs/inbox/index.js
@@ -45,3 +45,13 @@ export async function clearPMs (user) {
     Inbox.remove({ownerId: user._id}).exec(),
   ]);
 }
+
+export async function updateMessage (message) {
+  const messagesInDb = await Inbox
+    .find({id: message.id})
+    .exec();
+
+  const messageInDb = messagesInDb[0];
+
+  await messageInDb.update(message);
+}