A link in an email from a known sender is not automatically safe. The reliable test is verification through a separate channel, using contact details held independently of the message. Two mechanisms explain why: the sender account may have been taken over by someone else, or the name shown in the inbox may be a forgery placed over a different sending address. In the first case, visual checks of the sender fail because the address is genuine. In the second case, the checks work only when the full address is examined rather than the display name.
The known sender problem
Email clients display a name first and the full address second, and many recipients stop at the name. A display name is a label that can be set to almost anything, while the address behind it identifies the sending account. Trust placed in the name is trust placed in the easiest part of the message to imitate.
The FBI describes business email compromise, also called email account compromise, as a scam in which criminals send an email that appears to come from a known source making a legitimate request. Its examples include a regular vendor sending an invoice with an updated mailing address, a chief executive asking an assistant to buy gift cards, and a homebuyer receiving wire instructions from a title company. In each example, the message fitted the normal workflow of the person who received it, and the FBI states that versions of these scenarios happened to real victims.
The scale is large. The FBI Internet Crime Complaint Center 2025 annual report records 24,768 business email compromise complaints with $3,046,598,558 in reported losses. Those figures cover reported complaints, not every incident. Source: IC3 2025 report.
Account takeover
Account takeover means the real account, used by the wrong person. The takeover may follow a reused password exposed in a breach, an earlier phishing page, or malware that captured a session. Once inside, an attacker can read old threads, copy the tone of past messages, and send a link to contacts who already trust that address. A breach check service such as Have I Been Pwned can show whether an address has appeared in a known breach, but a clean result does not prove the account is still in its owner's hands.
The FBI states that business email compromise is frequently carried out when an individual compromises legitimate business or personal email accounts through social engineering or computer intrusion. Its September 2024 public service announcement reports 305,033 domestic and international incidents and $55,499,915,582 in exposed dollar loss between October 2013 and December 2023. That announcement covers business email compromise in general, so its figures should not be read as a count of hijacked personal accounts alone. The mechanism it describes is nevertheless the one that matters here: a legitimate account, used to send a request the owner did not write. More detail is in the FBI business email compromise alert.
Display name spoofing
Spoofing is the cheaper route, and it needs no access to the known person's account at all. The attacker registers a free account or a lookalike domain and sets the display name to the name of a person the recipient knows. The inbox shows the familiar name. The address underneath is different.
Microsoft defines user impersonation as the combination of a user's display name and a different email address, and gives the example of Valeria Barrios (vbarrios@contoso.com) impersonated as Valeria Barrios with a different address. That definition appears in Microsoft's anti-phishing policy documentation. The name and the address are separate fields, and only the address identifies the sender account. Microsoft's anti-spoofing documentation adds that spoofed messages appear to originate from someone or somewhere other than the actual source, and that the technique is often used in phishing campaigns designed to obtain user credentials.
Microsoft reported in January 2026 that spoofed messages in a routing-abuse campaign could appear internally sent, with the recipient address often in both the To and From fields and the display name changed to be more convincing. See Microsoft's report on spoofed domains. Lookalike domains make the deception harder to spot. The FBI notes that slight variations on legitimate addresses, such as john.kelly@examplecompany.com against john.kelley@examplecompany.com, fool victims into thinking inauthentic accounts are authentic. A single added letter, a swapped letter, a different top level domain, or a familiar name embedded in the middle of an unrelated domain can all pass a quick glance. The University of Michigan guide to spotting a spoof notes that forgers can sign up for a free account, create an address similar to someone else's name, and set the display name to anything they want.
Sender and link checks
Gmail warns when a sender looks like name@gmail.com but Gmail cannot verify that address, and advises against clicking links in that case. See Gmail's help page on unverified senders. Google's AdSense impersonation help gives similar advice. Three checks, in order, cover most cases without any special tool. The first is the sender details: expanding them shows the full address rather than only the display name, for comparison with the address used in past messages from the same person, checking the domain letter by letter and noting a free account where past messages came from a recognised work or personal domain. The second is the Reply-To address: a mismatch does not prove fraud on its own, since newsletters and shared inboxes use different reply addresses, but an unexpected mismatch on a personal message is a reason to stop.
The third check is the link destination, inspected without opening it. On a computer, hovering over a link shows its destination. On a phone, pressing and holding a link usually shows a preview. The destination that matters is the domain just before the first single slash after the scheme. A link whose visible text names one site while its destination names another is a spoofed hyperlink, which CISA lists as a common indicator of phishing. CISA's guidance on social engineering also warns that a malicious site may look identical to a legitimate site while its address uses a variation in spelling or a different domain, or hides behind a link shortener.
Verification through a separate channel
Verification through a separate channel means starting a new conversation through a route the attacker does not control. The apparent sender is contacted using details already on record: a saved phone number, a number from a previous statement, an official website found independently, or a message on a different platform where the two people already talk. The suspect email is not replied to, no number printed inside it is called, and its link is not clicked to "confirm" the request, because in the hijacked case the attacker reads the replies.
A reply address, a phone number, or a link supplied inside a suspect email all lead back to whoever sent it. Verification has to start from contact details held before the message arrived, not from anything the message itself provides.
CISA advises that if a reader is unsure whether an email request is legitimate, the reader should verify it by contacting the company directly, using contact information from previous statements rather than from a website connected to the request. The UK National Cyber Security Centre gives the same pattern for suspected impersonation: hang up and contact the organisation directly, for example using its official website. That advice appears in the NCSC guide to spotting scammers. A related guide to checking a suspicious email covers the sender and link checks in more detail.
Post-click steps
Clicking alone does not always mean harm, but what happens next decides the risk. If no password, code, or payment detail was entered, and no file was downloaded, the page is closed, unexpected downloads are checked for, and the message is reported. A guide to reporting a phishing email sets out the reporting routes. If a password was entered, that password is changed on the real site, reached by typing the address directly or using a saved bookmark, and changed on any other account that used the same password. If payment details were shared, the bank is contacted using a number from the card, not from the suspect message. The NCSC guidance on what to do after sharing information sets out these steps by situation, including changing reused passwords and running antivirus software after opening a link or installing software.
The receiving address and AliasFleet
AliasFleet provides email aliases that forward to a single destination inbox, with a separate alias for each service or contact. That design does not make links safe, and it does not stop a hijacked account or a spoofed name. A dangerous link arriving on an alias is still a dangerous link. The product page describes the service as one alias per website, with the ability to disable an alias when unwanted mail arrives on it. That description is on AliasFleet.
The factual use here is narrower. The alias a message arrived at shows where the sender expected the recipient to be reached. If a message claiming to be from a friend arrives on an alias given only to a shop or newsletter, that mismatch is visible before clicking, and it is a concrete reason to run the outside check. It does not prove malice, since addresses are shared in ways the recipient may have forgotten. The limit is that if a friend was genuinely given that alias, or the hijacked account already holds it, the message arrives on the expected alias and reveals nothing, so the outside check still matters.
Summary
The checks are the full address, the link destination, and verification through a separate channel using contact details already on record. The full address is read and compared with past messages, the link destination is inspected without opening it, and an unexpected request is verified through that separate channel. If verification is not possible, the link is left unclicked. That sequence catches spoofing, where the address or link gives the deception away, and it covers hijacking, where only the separate channel can show that the account owner did not send the message.
Top comments (0)