How to Tell If an Email Is a Scam Before You Click
Scam emails work because they push you to act before you think. They pretend to be banks, delivery companies, cloud storage providers, employers, invoices, password alerts, crypto platforms, government offices, or people you know. The design can look convincing. The sender name can look familiar. The message may even include your real name.
The safe way to judge an email is not by how polished it looks. Judge it by the action it asks you to take, the domain behind the sender, the destination behind the link, and the pressure it creates.
The 30-second scam check
Before clicking anything, ask four questions.
First, who is really sending it? Look at the full email address, not only the display name. A display name can say “PayPal” while the actual address is unrelated.
Second, what does it want you to do? Scam emails usually ask you to log in, verify an account, open an attachment, pay an invoice, call a number, buy gift cards, approve a transaction, or move a conversation somewhere else.
Third, where does the link really go? Hover over links on desktop or long-press carefully on mobile to preview the destination. A real-looking button can lead somewhere completely different.
Fourth, why the urgency? Phrases like “your account will be closed today,” “payment failed,” “final warning,” or “suspicious activity” are designed to rush you.
Sender names are easy to fake
Do not trust the name shown in your inbox. Email display names are like labels; attackers can write almost anything there. The real clue is the domain after the `@`.
For example, a real company email usually comes from a domain the company controls. A message claiming to be from a bank but sent from a free email address, strange subdomain, or misspelled domain is suspicious.
Also watch for lookalikes: `rn` instead of `m`, extra hyphens, added words, or domains that place the brand name before a different real domain. Scammers rely on quick glances.
Links matter more than logos
Logos are easy to copy. Links are harder to hide if you check them. A scam email may use a real logo, real colors, and real legal text, but send you to a fake login page.
Be careful with shortened links and tracking links. Not every tracking link is malicious, but if an email asks for sensitive action through a link you cannot understand, do not use it. Open your browser and type the official site manually, or use the company’s official app.
If the message says your bank account has a problem, do not click the email button. Open the bank app yourself. If the app shows no alert, the email was probably bait.
Attachments are high risk
Unexpected attachments are one of the oldest scam patterns. Invoices, shipping labels, resumes, scanned documents, shared files, and voicemail attachments can contain malware or lead to credential theft.
Be especially careful with files that ask you to enable macros, install a viewer, sign in again, or bypass browser warnings. If the sender is real, confirm through a separate channel before opening the file.
For business email, treat unexpected invoice changes, bank detail changes, and urgent payment instructions as high risk. Verify by phone using a known number, not the number inside the email.
Urgency and secrecy are warning signs
Scam emails often try to isolate you. They say not to tell anyone, to act immediately, or to keep the request confidential. This appears in fake boss emails, gift card scams, payroll scams, and account takeover attempts.
Real security alerts can be urgent too, but they should still survive verification. You can open the official app, call the official number, or check the account directly. A legitimate company does not need you to trust only the email.
When an email uses your real details
Scam messages sometimes include your name, phone number, old password, address, order history, or employer. That does not prove the email is real. Data leaks, public profiles, previous breaches, and scraped websites make personal details easier to obtain than most people expect.
If an email includes an old password, do not reply or pay. Change reused passwords, enable two-factor authentication, and check important accounts. Treat it as evidence that old data is circulating, not as proof that the sender controls your device.
What to do with a suspicious email
Do not reply. Do not click unsubscribe on a suspicious message unless it came from a known sender, because unsubscribe links can confirm your address is active. Mark it as spam or phishing in your email app.
If it pretends to be a company you use, forward it to that company’s phishing report address if they provide one. If it targets your workplace, report it to whoever handles IT or security.
If you already clicked a link but did not enter information, close the page and clear the site from your browser history if you want. If you entered a password, change that password immediately from the official site and enable two-factor authentication. If you entered payment details, contact the bank or card issuer.