Lena was halfway through her morning coffee when an email landed: “Unusual sign-in detected — verify your account within 24 hours.” It looked exactly like her bank's emails, with the same logo, colors, and footer. She was one tap away from clicking when she paused. She had never learned how to check if an email is legit, and this was exactly the moment that knowledge would have mattered.
She did the smart thing. She did not click. She opened her bank's app separately, logged in normally, and found nothing wrong — no alerts, no restrictions, no unusual sign-ins. The email was fake, and the “customer-service number” in its footer was not her bank's number at all. If she had clicked, she would have landed on a copycat login page built to harvest her credentials.
Email is still the cheapest way to reach victims at scale, and people reported losing $3.5 billion to imposter scams in 2025, according to the FTC. That is why a quick check before you click matters so much. Here is the 30-second test.
The 30-Second Email Authenticity Checklist
1. Read the sender address, not the display name. (5 seconds)
Your inbox shows a friendly name like “PayPal Security” or “IT Department.” Tap or hover to reveal the actual address. Display names are free — anyone can label an email “Amazon Support.” If the domain does not exactly match the company's official domain, nothing else in the email matters. Watch for lookalikes such as paypa1.com with a “1” instead of an “l,” amaz0n-support.net, or confusing subdomains like secure-login.chase.verify-now.com — the real domain there is verify-now.com, not Chase. A bank writing from a free address like bank-security-team@gmail.com is also a clear fake.
2. Hover over links to preview the destination. (10 seconds)
On a computer, hold your cursor over the link without clicking and read the address that appears. A button labeled “Verify My Account” can point anywhere. URL shorteners, random strings of letters, or any domain that is not the company's own should stop you.
3. Scan for urgency and threats. (5 seconds)
“Your account will be suspended in 24 hours.” “Immediate action required.” “Your package will be returned.” Real companies send statements and routine notices; they do not pressure you with countdowns and threats. Urgency is a tool scammers use, not customer service.
4. Check what it is asking you to do. (5 seconds)
Does it want your password, card number, one-time code, or a payment? Legitimate companies do not ask for those by email. The request itself is often the verdict.
5. Look at the greeting and the details. (3 seconds)
“Dear Customer” instead of your name is a warning sign — mass-sent fakes cannot personalize. Spelling errors, odd phrasing, and mismatched details are more red flags.
6. Ask: “Did I expect this?” (2 seconds)
An email you did not expect about an account you did not touch deserves suspicion by default. When in doubt, go to the source yourself.
Red Flags That Mean “Delete It Now”
- The sender domain is wrong or a lookalike
- Hovering reveals a link to a strange domain
- Threats or countdowns — “suspended in 24 hours,” “legal action,” “final notice”
- Requests for credentials, codes, or payments
- Unexpected attachments — invoices, “secure documents,” or delivery receipts you did not ask for
- Generic greetings plus specific threats
- The reply-to address differs from the sender
- It arrived about an account you do not have
Still Unsure? Escalate, Don't Click
Contact the company through a channel you trust: open its official app, type its website address yourself, or use a number from its official site — never use contact details from the suspicious message itself. Use your email provider's built-in tools, which often show authentication results or warnings.
If You Already Clicked or Replied
Do not panic — act in this order. If you clicked a link but entered nothing, close the tab and update your browser. If you entered credentials, change that password right away, turn on two-factor authentication, and change any other account that used the same password. Watch your accounts closely for the next few weeks for unexpected password-reset emails or unfamiliar activity.
How to Report a Phishing Email
Forward it to reportphishing@apwg.org (as an attachment if your email app allows it, so investigators get the full headers). Then report it at ReportFraud.ftc.gov and to the FBI's Internet Crime Complaint Center at ic3.gov. Also use your email provider's “report phishing” button.
The full guide, with sources from the FTC and CISA, is published on WarnScams: https://warnscams.com/how-to-check-if-an-email-is-legit/
Originally published on WarnScams.
Top comments (0)