An unexpected email says your account will be suspended. Another asks you to review an invoice or confirm a delivery. The logo looks familiar, and the message sounds professional. Should you trust it?
To check if an email is a scam, pause before replying, opening attachments, or following links. Examine the full sender address and the requested action, then verify the claim through a separate, trusted channel. Familiar branding and polished language do not prove legitimacy, and no single check can establish that an email is safe.
Before you do anything:
Do not reply or use contact details supplied in the suspicious email.
Do not open unexpected attachments or follow its links.
Open the organization’s known app or navigate independently to its official website.
If you already interacted, follow the recovery guidance below.
You do not need to become a cybersecurity expert to make a safer decision. Start by separating what the email claims from what you can independently confirm.
Check the Full Sender Address, Not Just the Display Name
Your inbox may show a name such as “Customer Support” or “Account Security.” That display name is a label, not proof of identity.
Expand the sender details, where your email app allows, and examine the complete address. Pay attention to the domain: the part after the @ symbol.
Microsoft identifies mismatched domains and subtle spelling changes as phishing warning signs.[1]
What a Misleading Sender Can Look Like
The following examples are fictional. Addresses use reserved example domains and are written with [.] to prevent accidental clicks.
What you see | What deserves attention |
|---|---|
“Example Account Support” using | The display name claims an identity the address does not establish. |
| The numeral “1” replaces the letter “l” in a lookalike domain. |
| The familiar text appears inside a longer domain. This is not |
Swipe to view the full table
If your app shows a Reply-To address in the message details, check that too. An unexpected address deserves investigation, although legitimate organizations sometimes use separate services to handle replies.
Do not compose a reply just to investigate.
A recognizable sender address is not conclusive either. Legitimate accounts can be compromised, and malicious messages can arrive through contacts you know.[2] Always consider the request itself.
Look at What the Email Is Asking You to Do
An email’s requested action often matters more than its appearance.
Take extra care when an unexpected message asks you to:
Sign in through a supplied link.
Pay an unfamiliar invoice.
Change a supplier’s banking details.
Provide identification or financial information.
Share a password or verification code.
Keep the request secret or bypass a normal approval process.
Phishing messages commonly use account problems, unfamiliar invoices, and requests to confirm information as reasons to act.[3]
Ask yourself: Would I normally complete this request this way?
For example, if a supplier asks you to send payment to a new bank account, confirm the change using a previously known phone number. Replying within the same conversation does not provide independent confirmation.
Urgency is a warning sign, not proof by itself. Genuine organizations can send deadlines. The question is whether the claim and requested action can be verified outside the email.
Assess warning signs together. A fraudulent message can have correct spelling, familiar branding, and a calm tone.
Examine Links Without Following Them
A link’s visible wording may differ from its destination. A button labeled “Review your account” does not tell you where it leads.
On a desktop, if your email client supports it, resting your pointer over a link without clicking can display its destination.[1] This may reveal a mismatch between the message’s claim and the actual address.
However, link inspection has limits:
Shortened URLs hide their destinations.
Previews may display only part of an address.
Long addresses can be difficult to interpret.
A familiar-looking destination is not a safety guarantee.
Do not tap or long-press an unfamiliar link unless you know how your particular app behaves. Some gestures may open the destination or load a preview.
If you cannot inspect a link safely, skip it. Open the organization’s known app or website separately.
Does HTTPS Mean the Link Is Safe?
No. HTTPS encrypts the connection between your device and a website. It does not establish that the website operator is trustworthy.
Scammers can encrypt their websites too.[4] A padlock cannot verify who sent the email or whether the request is legitimate.
Four Useful Checks—and Their Limits
Check | What to look for | Why it is not conclusive | Safer next step |
|---|---|---|---|
Sender address | Unexpected domain, spelling change, unusual Reply-To | Familiar accounts can be compromised; legitimate services may use different addresses | Confirm through a known contact or official channel |
Requested action | Unexpected login, payment change, sensitive information, secrecy | Genuine messages can also involve deadlines or account updates | Check whether the request exists independently |
Link destination | Mismatch, shortened address, misleading domain | A plausible address or HTTPS does not establish legitimacy | Open the known app or website yourself |
Appearance and wording | Inconsistent language, unusual formatting, generic greeting | Fraudulent messages can be polished and personalized | Base your decision on independent confirmation |
Swipe to view the full table
This table is a decision aid, not a scoring system. Several reassuring details do not make an unverified request safe.
Treat Unexpected Attachments With Caution
An invoice, ZIP archive, PDF, or office document may seem routine. Before opening it, ask whether you expected the file and whether you can verify why it was sent.
Do not open an attachment to discover whether it is malicious.
Be particularly cautious about instructions to enable macros. Macros are instructions that can automate actions inside documents. Do not enable them because an unexpected email tells you to.[2]
A familiar file extension or a scan that reports no threat is not a guarantee of safety. Keep the file closed while you confirm the request.
If it is a work message, follow your organization’s reporting process. Ask IT how to submit it safely rather than forwarding it to coworkers.
Verify the Claim Through a Separate Channel
Independent verification means leaving the route proposed by the email and using contact information you already trust.
The FTC recommends contacting a company through a phone number or website you know is real, rather than information in a suspicious message.[3]
Here is how to apply that advice.
Delivery Notice
Open the carrier’s official app or website yourself. Use the tracking number from your original order confirmation or retailer account, rather than relying on details supplied in the suspicious notice.
Bank Warning
Open your banking app or call the number printed on your bank card. Ask whether the warning and requested action are genuine.
Do not call a number supplied in the email to confirm that same email.
Workplace or Family Request
Call the person using a saved number or contact them through an established channel.
Confirm the specific request, especially if it involves money, confidential information, secrecy, or an unusual favor. Recognizing the person’s name is not enough.
What If You Still Cannot Confirm It?
Do not assume the first search result, sponsored listing, or displayed phone number is official. Prefer a known app, saved bookmark, bank card, or previous statement.
If your account shows no corresponding notice, that alone may not settle the question. Contact established support when the claim matters.
While uncertainty remains, leave the request unfulfilled. You do not have to prove that an email is fraudulent before deciding not to act on it.
Example: A Suspicious Email, Explained
Fictional illustration—not an observed campaign. The service, message, and addresses below are invented. Addresses use reserved example domains and are defanged.
From: Example Account Security
Sender:notice@accounts[.]example
Reply-To:verification@helpdesk[.]example
Subject: Confirm your account within 30 minutesHi Alex,
We could not complete your account verification. Your access will be suspended unless you confirm your identity within 30 minutes.
Select Keep my account active and enter your password and the security code sent to your phone. Do not contact support while verification is pending, as this may delay the process.
Displayed destination:
example[.]com.verify[.]example
Five Warning Signs
The sender’s identity is unconfirmed. “Example Account Security” is a display name, not evidence of authority.
The reply address changes. That adds a detail to investigate, although a different Reply-To alone would not prove fraud.
The deadline creates pressure. The threat of losing access encourages action before verification.
The request targets account access. It asks for a password and security code through an unsolicited process.
The message discourages independent contact. It tries to keep the reader inside the route it controls.
The destination also contains familiar-looking text inside a longer domain. It is not example[.]com.
The safer next step: Open the service’s known app or saved website separately. Check account notices and contact established support if necessary. Do not use the email’s button or reply address.
The greeting “Hi Alex” does not resolve these concerns. Knowing your name does not authenticate a sender.
What an AI Email Scam Checker Can—and Cannot—Tell You
SamFindr uses AI to help assess suspicious emails, texts, and links for scam indicators. Its website describes analysis of suspicious content and guidance about the result.
An AI email scam checker can offer another perspective on a confusing message. However, an assessment has limits:
It may miss a threat.
It may flag a legitimate message.
It cannot establish with certainty that an important request is genuine.
Use the result to support your judgment, then independently verify requests involving account access, money, or sensitive information.
Before submitting content, remove passwords, verification codes, full financial details, and unnecessary personal information. Follow your organization’s rules before sharing workplace content with an external tool.
Still unsure about a message? Use SamFindr to help assess its warning signs, then verify important requests through an independent channel.
What If You Already Clicked, Replied, or Shared Information?
Pause and identify what happened. Your next steps should match the interaction.
Clicked Only
Close the page. Do not enter information, accept downloads, or follow further instructions.
Clicking alone does not establish that your device is infected. If you suspect harmful software downloaded, update your security software and run a scan.[3] For a work device, notify IT.
Entered a Password or Verification Code
Use the official app or website to secure the affected account immediately. Change the password and any reused passwords, and enable multifactor authentication.
If you shared a code, tell the provider. Changing a password alone may not resolve every form of account access. Contact workplace IT for work accounts.[1][5]
Downloaded or Opened a File
Do not open a downloaded file or run it again. If you opened or ran it, contact workplace IT where applicable.
Update your security software, scan the device, and seek help from a trusted support provider if needed.[3][5]
Shared Payment Information or Sent Money
Contact your bank, card issuer, or payment provider immediately through a trusted channel. Explain what happened and ask about securing your account and stopping or reversing the transaction.
Recovery is not guaranteed.[5][6]
In Canada, follow the Canadian Anti-Fraud Centre’s reporting guidance and contact local police after fraud. In the US, report scams through the FTC; its guidance directs identity-theft victims to IdentityTheft.gov.[5][6]
If you only replied, stop the conversation. If your reply included sensitive information, follow the relevant steps above.
Frequently Asked Questions
Can a Scam Email Come From a Real Email Address?
Yes. A legitimate account can be compromised. A recognizable address does not independently confirm that the request is genuine.
Does Good Grammar Mean an Email Is Legitimate?
No. Malicious emails can use polished language, including content produced with AI.[2] Focus on the request and verify it separately.
Is an Email Safe If It Uses My Name?
No. Knowing your name does not prove who sent the message. Personalized emails still need verification.
Does HTTPS Mean a Linked Website Is Trustworthy?
No. HTTPS protects the connection to a website. It does not establish that the website operator is legitimate.[4]
Can AI Tell Me for Certain Whether an Email Is a Scam?
No. AI assessments can be wrong in either direction. Use them alongside independent verification, especially when a request involves money, account access, or sensitive information.
Pause, verify independently, and avoid acting on an unverified request. You do not need certainty about the sender’s intentions to choose a safer next step.
Sources
All sources accessed October 16, 2026.
Microsoft Support: Protect yourself from phishing.
Canadian Centre for Cyber Security: Spotting malicious email messages (ITSAP.00.100).
US Federal Trade Commission: How To Recognize and Avoid Phishing Scams.
US Federal Trade Commission: Are Public Wi-Fi Networks Safe? What You Need To Know. See its explanation of encrypted scam websites.
US Federal Trade Commission: What To Do if You Were Scammed.
Canadian Anti-Fraud Centre: What to do if you’re a victim of fraud.
Product information: SamFindr.
