Lena was halfway through her morning coffee when the email landed. Subject line: “Unusual sign-in detected — verify your account within 24 hours.” It looked exactly like her bank’s emails — same logo, same colors, same footer with the customer-service number. The message said someone had tried to log in from another country and her account would be restricted unless she confirmed her identity through the link provided. Her stomach dropped. She was one tap away from clicking when something stopped her: she’d never learned how to check if an email is legit, and this was exactly the moment that knowledge would have mattered.
She did the smart thing. She didn’t click. She opened her bank’s app separately — logged in normally, no link — and found nothing wrong. No alerts, no restrictions, no unusual sign-ins. The email was fake. The “customer-service number” in its footer? Not her bank’s number at all. If she’d clicked that link, she’d have landed on a copycat login page built to harvest her credentials, and the scammers would have walked straight into her real account.
Lena’s story plays out millions of times a year, because email is still the cheapest way to reach victims at scale. The FTC reports that people lost $3.5 billion to imposter scams in 2025 — nearly three times the 2020 figure — with fraudsters reaching victims through email, text, phone, and social media. The good news: you don’t need security training to beat most of these emails. You need about 30 seconds and a checklist.
The 30-second answer: check the sender’s actual email address (not the display name), hover over any link to preview its real destination without clicking, and ask whether the email demands urgent action or sensitive information. Then verify through a channel you trust — the company’s app or a phone number you already have, never the contact details inside the message. If any check fails, treat the email as fake.
The 30-Second Email Authenticity Checklist
Run these six checks in order. None requires technical skill — just the discipline to pause before you click. If the email fails even one, stop and treat it as suspicious.
- Read the sender address, not the display name. (5 seconds) Your inbox shows a friendly name like “PayPal Security” or “IT Department.” Tap or hover to reveal the actual address. If it says anything other than the company’s real domain — random letters, a lookalike domain, a free email provider for a “bank” — it’s fake.
- Hover over links to preview the destination. (10 seconds) On a computer, hold your cursor over the link without clicking and read the address that appears. On a phone, press and hold the link to preview it. Never tap through to “see where it goes” — previewing is safe, visiting is not.
- Scan for urgency and threats. (5 seconds) “Your account will be suspended in 24 hours.” “Immediate action required.” “Your package will be returned.” Urgency is the scammer’s favorite tool because it switches off your judgment. Real companies don’t threaten you into clicking.
- Check what it’s asking you to do. (5 seconds) Does it want your password, card number, one-time code, or a payment? Legitimate companies don’t ask for sensitive information by email. Full stop.
- Look at the greeting and the details. (3 seconds) “Dear Customer” instead of your name is a warning sign — mass-sent fakes can’t personalize. So are small inconsistencies: wrong logo colors, odd phrasing, a footer phone number that doesn’t match the one on the company’s real site.
- Ask: “Did I expect this?” (2 seconds) An email you didn’t expect about an account you didn’t touch deserves suspicion by default. When in doubt, go to the source yourself — open the app, type the website address manually, or call a number you already trust.
Reading the Results: What Each Check Tells You
The sender address is the single most revealing check. Display names are free — anyone can label an email “Amazon Support” or “Chase Fraud Department.” The domain after the @ is what matters. Learn to spot the tricks: lookalike domains (paypa1.com with a “1” instead of an “l”, amaz0n-support.net), subdomains designed to confuse (secure-login.chase.verify-now.com — the real domain is the last two parts, verify-now.com, not Chase), and free providers (bank-security-team@gmail.com). If the domain doesn’t exactly match the company’s official one, nothing else in the email matters.
The hover test exposes the bait. A button labeled “Verify My Account” can point anywhere. Scammers count on you trusting the label. Previewing the link costs nothing and reveals everything — a login page for your bank should live on your bank’s domain. Our guide to what a phishing link actually looks like under the hood breaks down the anatomy in more detail.
Urgency is a confession. Think about how real companies communicate. Your bank sends statements and routine notices; it does not email you countdown timers. Scammers manufacture panic — account closure, legal action, a missed delivery — because a frightened reader clicks first and thinks later. Any email that makes your pulse quicken should make you slow down instead.
The request itself is the verdict. CISA’s national cybersecurity guidance puts it plainly: think before you click, and be cautious of any unsolicited email asking for personal information. The rule is simple enough to memorize — real companies don’t email you links to update payment details, don’t ask for one-time codes by email, and don’t request passwords. Only scammers do that. When an email’s core request breaks that rule, the email is fake regardless of how polished it looks.
Red Flags That Mean “Delete It Now”
- The sender domain is wrong or a lookalike — the clearest possible sign, and the one scammers hope you never check.
- Hovering reveals a link to a strange domain — URL shorteners, random strings of letters, or any domain that isn’t the company’s own.
- Threats or countdowns — “suspended in 24 hours,” “legal action,” “final notice.” Pressure is a tool, not a customer-service style.
- Requests for credentials, codes, or payments — passwords, one-time passcodes, card numbers, gift cards, wire transfers. CISA reminds consumers that government agencies will never demand payment by gift card, wire transfer, or cryptocurrency — and neither will your bank.
- Unexpected attachments — invoices, “secure documents,” or delivery receipts you didn’t ask for. Don’t open them; attachments can carry malware.
- Generic greetings plus specific threats — “Dear Customer, your account ending 4821 will be closed.” If they know your account number but not your name, they bought a data list, not your trust.
- The reply-to address differs from the sender — check it. Replies routed to a random address are a dead giveaway.
- It arrived about an account you don’t have — a “Netflix” warning when you’ve never subscribed is an easy delete, but it also confirms scammers are spraying these widely.
These overlap heavily with the warning signs in our phishing red-flags checklist — worth a read if you want the pattern recognition drilled in. And if the “urgent email from the boss” variant lands in your work inbox, that’s a different species: CEO fraud, where attackers impersonate an executive to push fraudulent transfers.
How to Check If an Email Is Legit When You’re Still Unsure
Sometimes an email passes the quick checks but still feels off. That’s when you escalate from the 30-second test to real verification — and the golden rule never changes: never use contact details from the suspicious message itself.
First, contact the company through a channel you trust. Open its official app, type its website address into your browser manually, or call the number on the back of your card — not the number in the email. Ask whether the message is real. Second, check your account directly: log in normally and look for the alert, charge, or notice the email claims exists. If it’s not there, the email invented it. Third, search the web for the email’s exact subject line plus the word “scam.” Mass phishing campaigns get reported quickly, and you’ll often find the identical text flagged within days.
Fourth, use your email provider’s built-in tools — most now show authentication results or warnings on suspicious messages, and all offer a “report phishing” button. Fifth, when the stakes are high (money movement, password resets, tax documents), default to the slowest, most boring verification method available: a phone call to a known number. Boring is safe.
What to Do If You Already Clicked or Replied
Don’t panic — act in this order. If you clicked a link but entered nothing, close the tab, update your security software, and run a full scan; some phishing pages attempt drive-by malware. If you entered credentials, change that password immediately — and change it everywhere else you reused it — then turn on multi-factor authentication on the account. If you handed over card or bank details, call your bank or card issuer right away, report the fraud, and ask about freezing or replacing the card. If you shared your Social Security number or ID documents, visit IdentityTheft.gov for a personalized recovery plan.
Then watch your accounts closely for the next few weeks: unexpected password-reset emails, unfamiliar logins, small test charges. Scammers often wait before using stolen data. Our step-by-step guide to what to do right after clicking a phishing link walks through the full cleanup in order.
How to Report a Phishing Email
Reporting takes a minute and it matters — the FTC uses complaint data to map campaigns, prioritize enforcement, and issue public warnings. Forward the phishing email to the Anti-Phishing Working Group at reportphishing@apwg.org (forward as an attachment if your email app allows it, so investigators get the full headers). Then report it to the FTC at ReportFraud.ftc.gov, and file a complaint with the FBI’s Internet Crime Complaint Center at ic3.gov, which tracks phishing as part of its internet crime data. Use your email provider’s “report phishing” button too — it trains their filters to catch the next wave. If the email impersonated your employer, forward it to your IT or security team as well; one report can protect your whole organization.
Sources
- U.S. Federal Trade Commission, press release, June 2026 — “FTC Data Show People Reported Losing $3.5 Billion to Imposter Scams in 2025” (reported imposter-scam losses nearly tripled since 2020; ~$16 billion in total reported fraud losses in 2025): https://www.ftc.gov/news-events/news/press-releases/2026/06/ftc-data-show-people-reported-losing-3-point-5-billion-imposter-scams-2025
- U.S. Federal Trade Commission, Data Spotlight, April 27, 2026 — “New FTC Data Show People Have Lost Billions to Social Media Scams” (consumers reported $2.1 billion lost to scams starting on social media in 2025, an eightfold increase since 2020): https://business.cch.com/ald/NewFTCDataShowPeopleHaveLostBillionstoSocialMediaScams_FederalTradeCommission042826.pdf
- Cybersecurity and Infrastructure Security Agency (CISA), national public awareness campaign, September 26, 2023 — “CISA Launches National Public Service Announcement Campaign Encouraging Americans to Take Steps to Keep Themselves and Their Families Safe Online” (Secure Our World guidance: recognize and report phishing — think before you click; don’t open links or attachments from unknown sources): https://content.govdelivery.com/accounts/USDHSCISA/bulletins/372a509
- Cybersecurity and Infrastructure Security Agency (CISA), alert, March 4, 2020 — “Social Security Administration Designates March 5 as National ‘Slam the Scam’ Day” (CISA consumer reminders: government agencies never demand immediate payment via gift cards, wire transfers, or cryptocurrency): https://www.cisa.gov/news-events/alerts/2020/03/04/social-security-administration-designates-march-5-national-slam-scam-day
Last reviewed: October 2026
This article is for education only and is not financial or legal advice.
Pingback: 12 Red Flags of Phishing Emails and Messages (and How to Check Any Link Safely) - Warn Scams