A suspicious email can look familiar, so check what it asks you to do before trusting its appearance. A scam email may try to get personal information, money, or access to an account. No single clue proves the message is fake, but several clues together deserve attention.
Spoofing means disguising an email address, sender name, phone number, or website URL to make it look like it belongs to a trusted source. Online scams can also use real logos and polished wording. Pause before sharing personal information or taking an urgent action. That small break gives you time to think without letting the sender set the pace.
Check a request through a separate route before you act. For example, use contact details you already trust instead of details included in the unexpected message. This simple habit can help protect your account security without asking you to judge a message by its looks alone.
Treat an unexpected request for sensitive information as a reason to verify the message independently.
Key Takeaways
- Pause before responding to an unexpected request.
- Check the sender’s full address, not just the display name.
- Look for pressure, requests for information, and odd links.
- Preview a link’s destination without opening it.
- Confirm unexpected files through a trusted channel.
- Act quickly if you entered a password or device code.
How to Identify a Scam Email by Checking the Sender
A message that appears to come from your bank can still use a sender address with an extra character or a different domain. Check the full email address and greeting before you trust the sender. The display name alone does not prove who sent the message.
Compare the address with one you find on the organization’s known website. Phishing emails may imitate banks, credit card companies, social networking sites, online payment services, apps, and online stores. A set of Brooklyn College phishing examples shows how sender names and addresses can differ.
A familiar display name is not proof that the email came from the organization it names.
Inspect the full email address
Email apps often show a sender name more clearly than the underlying address. Open the sender details to inspect the full email address, including the part after the @ symbol. Spoofing can change one letter, symbol, or number, making a false address look close to a real one.
A slightly altered domain may imitate a trusted organization. Compare each part with a known address, rather than relying on a familiar logo or name. A free email scammer check can help inspect an address or URL, but no checker can prove a message is safe.
Notice generic or inconsistent greetings
A generic greeting, such as “Dear customer,” can be a clue, especially when the organization usually addresses you by name. A signature that conflicts with the sender’s claimed role also deserves a closer look. Yet a real message may omit a greeting, so neither detail proves fraud by itself.
A scam email checker should not need your private message contents or account credentials just to assess a sender. Use the table to sort what you notice from what it might mean.
| Check | What you see | What to inspect | What it may mean |
|---|---|---|---|
| Display name | Bank Support | Underlying address | Name may be copied |
| Full email address | Extra letter or number | Domain after @ | Lookalike sender |
| Greeting/signature | Generic greeting | Match to the message | Clue, not proof |
If the sender’s identity is uncertain, do not reply with personal information.
Which Message Details Signal Pressure or a Data Grab?
An unexpected notice that an account is locked or a payment failed is a reason to slow down, not rush to respond. Phishing uses social engineering, or pressure that steers you toward a quick choice. Urgency is a warning clue, not proof that an email is fake.
Pause when a message pushes you to send money or disclose personal information. Phishing emails may claim:
- Suspicious activity on your account
- A problem with a payment
- A need to confirm personal information
- A required payment
- Eligibility for a government refund or free coupon
A scam email example might say a payment failed and demand confirmation. Another might promise a government refund or free coupon. Both use familiar concerns or rewards to get a fast response.
CISA flags urgent or emotionally appealing language, requests for personal or financial information, shortened URLs, and misspelled email addresses or links. Those clues can help you identify phishing, but no single one settles the question.
Polished grammar and spelling do not prove that a message is genuine. Fluent writing can still carry false claims, just as AI-generated writing patterns cannot prove who wrote a passage. Treat wording as one clue, not a reliable test of the sender.
Never send a password, payment detail, or other personal information just to stop a threat in an unsolicited message.
How Can You Check a Link Without Opening It?
A button labeled “View account” can lead to a different site than its wording suggests. Preview the actual URL without opening the link, then compare it with the organization’s known website. The displayed words may not match the destination.
The safest check is to avoid the email link and open the known website independently. You can also contact the organization using details found separately. This is the best way to check a request that might be real, without trusting the link in the message.
Preview the actual destination
On a computer, move your pointer over a link without clicking. Many email apps show the destination near the bottom of the window or in a small preview. On a phone or tablet, tap and hold the link to view its destination. Do not choose an option that opens it.
A link in a scam email can show trustworthy text while leading somewhere else. The Brooklyn College guide to phishing emails also explains how hovering can reveal a different destination.
Read the full URL carefully. A shortened URL can hide where it leads, and a long address can make a small change easy to miss. If the preview is unclear, do not use the email link.
Watch for lookalike websites and domains
A phishing website may copy a bank or credit card website, then ask for passwords, credit card numbers, or banking PINs. The fake page can look convincing while its URL contains a misspelling or a different domain ending, such as .net instead of .com.
Compare the domain with the address you use for that organization. Look for added words, swapped letters, or an ending that does not fit. Fake websites often rely on a quick glance, so slow down before entering account details.
Never enter sensitive information on a page reached through an email link if its identity is unclear. A known website opened on your own is a safer route to the same service. If a link’s destination does not match the organization and purpose of the message, leave it unopened.
Why Are Unexpected Attachments Risky?
An unexpected invoice or document attachment can be a delivery route for malware, even when the email sounds routine. Some malicious emails use a file to install harmful software or lead you to a fake sign-in page. A familiar format does not make an unexpected file safe.
Do not open an attachment until you know why it was sent. CISA identifies unsolicited attachments and messages urging immediate downloads as possible malware-delivery attempts. That warning does not mean every attachment is harmful. It means the file deserves a check before you interact with it.
Look for these attachment warning signs:
- A file you were not expecting
- A sender urging immediate opening or download
- A message that does not explain why the file is relevant
- An attachment paired with an unexpected sign-in or software-install request
A known contact can have a compromised account, so a familiar name does not settle the question. A routine-looking file may still be out of place, especially when the message gives no clear reason for sending it.
Some files ask you to enable active content or install software before you can view them. That request changes the risk: the file is asking you to take another step, not simply read a document. Check with the sender through a separate, trusted channel first.
Do not open or download an attachment until you have confirmed its purpose through a separate, trusted channel.
What If You Entered a Password or Device Code?
Entering a code into a legitimate Microsoft page can still grant access to an attacker if the code came from a deceptive email. A device code is a one-time code used to authorize a device. The page can be real while the request is not.
If a work account is involved, contact your IT or security team immediately. Opening an email without interacting with it is different from entering credentials or a device code. Entering either can give someone access to your account.
Understand the device-code example
First seen in April 2026, the Kali365 phishing-as-a-service platform can provide AI-generated lures, campaign templates, targeted tracking dashboards, and OAuth-token capture. An OAuth token is permission that lets an app or device access Microsoft services.
In the 2026 Kali365 attack, an email impersonates a trusted cloud productivity or document-sharing service. It asks you to enter a device code on a legitimate Microsoft verification page. The real page does not make the emailed request safe.
Entering that code can authorize an attacker’s device and capture OAuth access and refresh tokens. Stolen tokens can give persistent access to Outlook, Teams, and OneDrive without another password or multifactor authentication (MFA) challenge. Fluent AI-generated lures still need to be judged by their request, not their polish.
Secure the affected account
Change a compromised password from the official account website, not through the email. Revoke unfamiliar sessions or device access, then check the account’s MFA settings. Review recent sign-ins and report activity you do not recognize.
Microsoft explains how to review unusual sign-in activity and secure an account. A password change may not remove access granted through a device code or stolen token. Your workplace team can check access and sessions across managed services.
Act promptly on unfamiliar sign-ins or sessions rather than assuming a password change alone removed every form of access.
How Do You Verify and Report a Suspicious Message?
If a request might be real, contact the organization using details you found independently, not the phone number or link in the message. Report suspicious email through a channel that fits the case, then delete it. Do not use an email address lookup to claim you know who controls that address.
Use this three-step order:
- Verify a possible request through independently found contact details.
- Report the message through an appropriate channel.
- Delete it without clicking links, attachments, or unsubscribe links.
| Route | How to submit | What to expect |
|---|---|---|
| Email provider | Use its phishing-report button | Provider reviews the report |
| ReportFraud.ftc.gov | Paste message text in Comments | Shared with over 2,000 law enforcers |
| reportphishing@apwg.org | Send the phishing email | Phishing email reporting address |
| IC3.gov | Include Kali365 details | Attach available emails, login details, and device sessions |
The FTC cannot accept forwarded phishing emails. Paste the message text into the Comments field of its online fraud report instead. FTC reports are shared with over 2,000 law enforcers, but the agency does not resolve individual reports.
Never use an email’s own unsubscribe link to handle a message you suspect is phishing.
After reporting, delete the suspicious message and leave its links and attachments untouched.
Conclusion
The safest response to an email that creates doubt is to pause before giving it information or access. An unexpected request for money, sensitive information, or account access deserves independent verification. Your email provider’s report-phishing feature can help flag a suspicious message.
Trust the action you can confirm, not the pressure in the message. If you already entered a password or code, act quickly to protect the account and review active access.
Use your email provider’s report-phishing button on the next suspicious message, then delete it.
FAQ
Why should you never delete spam emails?
You do not need to keep ordinary spam emails. Report a suspicious message first, then delete it unless you need a copy as evidence for a fraud report or investigation. Keep that copy in a safe place, such as a folder that does not invite you to open its links or attachments. Deleting routine junk helps keep your inbox clear.
When suspicious email messages arrive in your inbox, you?
Do not click links, reply, or open attachments when a suspicious email arrives. Verify a request independently if it could be real, then report the message through your email provider. Delete it after reporting. If you entered account details or a code, take steps to secure the affected account instead of treating the message as ordinary spam.
What are 5 key signs of phishing?
Five key signs are an unfamiliar or mismatched sender address, a generic greeting, an urgent demand, a request for sensitive information, and a suspicious link or attachment. Any one sign can appear in a real message, too. Several clues together deserve more care. Verify the request using a trusted route before sharing details or sending money.
How does email identify spam?
Email providers use signals such as sender reputation, authentication, message content, links, attachments, and user reports to sort spam. Their filters compare those signals with patterns linked to unwanted or harmful messages. Filtering can make mistakes, so a wanted email may land in spam, or an unwanted one may reach your inbox. Review the folder when you expect a message.
Do spammers know when you open their email?
Sometimes, tracking pixels or remote images can tell a sender that an email was opened. That signal does not prove who read it, since another person or an automatic system might load the image. Blocking remote images can reduce this tracking. Avoid replying to a suspicious sender just to test whether the email is active.
What should you never open in spam emails?
Do not open links or attachments in a suspicious spam email, including an unsubscribe link. Those items can lead to fake sign-in pages or harmful downloads. Report the message through your email provider instead. For routine junk, use the provider’s spam controls rather than replying or following a link inside the message.
What happens if you open a spam email but don’t click anything?
Simply viewing a plain email is usually lower risk than clicking or downloading, but it is not risk-free. Remote images can signal that the email was opened, and rare software flaws can affect a device. Keep your device updated, avoid interacting with suspicious content, and report or delete the message. Opening alone is different from entering a password.
Should I just ignore spam emails?
Do not engage with or reply to spam emails. Report a suspicious message, then delete it; use your provider’s spam controls for routine junk. Replying can confirm that your address is active, while a link or attachment can expose you to more risk. If a message might be legitimate, verify it through contact details found independently.
