How to check if an email is real or a scam

An email says your account will be suspended, a parcel couldn't be delivered, or an invoice is overdue. It has the right logo and a reasonable tone. Part of you thinks it's probably fine. Another part isn't sure.

Most advice at this point is a list of warning signs, and we have one of those too: 8 signs of a phishing email. This guide is different. It's a method you can follow for any email, one step at a time, that ends with a clear answer instead of a gut feeling.

The golden rule before you start: don't click anything in the email while you're checking it. Everything below can be done without touching a link or an attachment.

Step 1: Notice the pressure

Before looking at anything technical, ask what the email wants you to feel. Scams almost always rely on one of four emotions: fear ("your account will be closed"), urgency ("within 24 hours"), greed ("you've won", "refund pending") or helpfulness ("the CEO needs this done quietly").

Real companies rarely put a countdown on anything important. When an email is pushing you to act quickly, that pressure is the first piece of evidence, and your cue to slow down.

Step 2: Look at the actual sender address

Your inbox shows a friendly name like "Amazon" or "HR Department". That name can be anything; what matters is the address behind it. On a computer, hover over or click the name. On a phone, tap the sender's name to expand it.

Then read the part after the @ carefully, from the right. The domain that matters is the last two parts (or three, for addresses like .co.uk):

• support@amazon.com: domain is amazon.com. Plausible.
• support@amazon.com.account-check.net: domain is account-check.net. Everything before it is decoration.
• security@arnazon.com: "rn" pretending to be "m". Easy to miss on a phone screen.
• billing@paypa1.com: the number 1 instead of the letter l.
• ceo.office@gmail.com: a free address claiming to be your boss or a company.

A mismatch here is almost always the end of the investigation: the email is fake. A correct-looking address, though, isn't proof on its own, so keep going.

Step 3: Check where replies would go

Some scams use a real-looking sender but a different Reply-To address, so when you reply, your answer goes to the scammer. This is common in fake invoice and "CEO" scams.

Press Reply (don't send anything) and look at the address that appears in the To field. If it's different from the sender, and especially if it's a free Gmail or Outlook address, treat the email as a scam. Then delete your draft.

Step 4: Read the hidden headers (the step most people skip)

Every email carries a hidden technical record, called the headers, showing which servers handled it and whether it passed the sender checks that mail providers run automatically. This sounds intimidating, but you only need to read three words.

In Gmail

1. Open the email.
2. Click the three dots (⋮) next to the reply arrow.
3. Choose Show original.

A page opens with a small summary table at the top. Look for three lines: SPF, DKIM and DMARC.

In Outlook

In Outlook on the web and the new Outlook app, open the email, click the three dots (…), then View → View message source (or View message details). In classic Outlook for Windows, open the email and go to File → Properties, and look at the Internet headers box. Search the text for spf=, dkim= and dmarc=.

What the results mean

The most important thing to understand: a pass is not a safety certificate. A scammer who registers secure-bank-login.com can set up perfect SPF, DKIM and DMARC for their own domain. The checks prove the email came from the domain it names; your job in Step 2 was to decide whether that domain is the right one. If you're curious how these checks work, we explain them in SPF, DKIM and DMARC, explained simply.

Step 5: Inspect the links without clicking them

On a computer, hover over a link and look at the address that appears in the bottom corner of the browser. On a phone, press and hold the link until a preview shows the address, then let go without opening it.

Apply the same right-to-left reading as with sender addresses. In https://paypal.com.verify-login.co/account, the real website is verify-login.co. Watch for link shorteners (bit.ly and similar) in messages that claim to come from banks or big companies; real ones almost never use them for account emails.

Also notice mismatches: a button saying "View your DHL parcel" that points to a random domain, or an email from your bank whose links go somewhere that isn't your bank.

Step 6: Treat attachments as guilty until proven innocent

Unexpected attachments are one of the main ways malware spreads. Be especially wary of:

• Office files that ask you to "Enable content" or "Enable macros".
• ZIP, RAR or ISO archives, particularly password-protected ones (the password stops security scanners from looking inside).
• HTML attachments, which often open a fake login page locally.
• Files with double extensions, like invoice.pdf.exe.

If you weren't expecting a file, don't open it until you've confirmed with the sender, which brings us to the most reliable step of all.

Step 7: Confirm through a second channel

This single habit defeats nearly every scam, including the clever ones that pass every technical test (for example, emails sent from a real account that was hacked).

• For companies: close the email, open the company's app or type its website address yourself, and log in. If there's really a problem, you'll see it there.
• For people you know: call or message them on a number you already have. Never use the phone number in the suspicious email itself.
• For payment changes ("our bank details have changed"): always confirm by phone with someone you've dealt with before. This one scam costs businesses billions every year.

What real companies don't do

No legitimate bank, payment service, marketplace or government agency will:

• ask you to reply with your password, PIN or full card number;
• ask you to share a verification code they just sent you;
• ask you to pay with gift cards or cryptocurrency;
• threaten legal action or arrest by email and demand immediate payment.

If an email does any of these, you already have your answer.

If you already clicked or replied

Don't panic, and don't hide it. Acting in the first hour makes the biggest difference.

1. Entered a password? Change it right away on the real site, plus anywhere else you use the same password. Turn on two-step verification.
2. Entered card or bank details? Call your bank using the number on your card and ask them to block it.
3. Opened an attachment? Disconnect from the internet, run a full scan with your security software, and at work, tell IT immediately.
4. Sent money? Contact your bank at once. Transfers can sometimes be stopped if you're quick.
5. Report it. In Gmail, use ⋮ → Report phishing. In Outlook, use Report → Report phishing. It helps protect other people too.

A 30-second version for busy days

If you remember nothing else, remember this: real address, real link, real channel. Check that the sender's domain is the right one, check that links go where they claim, and when money or passwords are involved, confirm by going to the company or person directly. That covers almost everything.

And to cut down how many scams reach you in the first place, keep your main address off sites you don't trust. A temporary email for one-time sign-ups keeps your real inbox out of the leaked lists that scammers buy.