Is This Email Real? How to Verify Before You Click

Why Email Verification Matters

Email is the most common way scammers reach victims. In 2025, phishing emails stole over $10.3 billion from Americans, with a single click costing victims an average of $5,700. These emails look increasingly legitimate, copying real companies' designs, logos, and writing styles.

The good news: with the right knowledge, you can spot nearly every phishing email before it causes harm. This guide teaches you to examine emails like a security expert, using simple techniques that take just 30 seconds.

Step 1: Examine the Sender's Email Address

The sender's email address is your first and most reliable clue. Scammers can fake a display name, but the actual email address is harder to disguise.

How to Check the Real Email Address

On computer: Click on the sender's name. The full email address will appear. In Gmail, you can also hover over the name to see details.

On smartphone: Tap the sender's name or photo at the top of the email. The full email address will display.

Common Sender Address Red Flags

• Misspellings: amaz0n.com (with a zero), paypa1.com (with a one)
• Extra words or hyphens: amazon-security.com, support-apple.com
• Wrong domain extensions: netflix.net instead of netflix.com, irs.com instead of irs.gov
• Free email services: Legitimate companies don't send official notices from @gmail.com, @yahoo.com, or @outlook.com
• Random characters: service@amzn-2024-support.net

Step 2: Hover Over Links (Don't Click!)

Phishing emails contain malicious links that look legitimate in the email text but actually lead to fake websites. You can reveal the real destination without clicking.

How to Check Links Safely

On computer: Place your mouse cursor over any link in the email. Don't click—just hover. After 1-2 seconds, a small box will appear showing the actual URL the link goes to.

On smartphone: Press and hold on the link. A menu will appear showing the full URL. Tap outside the menu to close it without following the link.

Link Red Flags

• URL doesn't match company name: Amazon links should go to amazon.com, not other domains
• IP addresses instead of names: Links like http://192.168.0.1 are highly suspicious
• Suspicious URL shorteners: Bit.ly, tinyurl links that hide the real destination
• Extra subdomains: security.verify.amazon-check.com (real Amazon uses just amazon.com)
• Misspellings in the URL: Any variation of the company's real domain name

Step 3: Look for Urgency and Threats

Phishing emails manipulate your emotions to bypass logical thinking. They create panic, fear, or false hope to make you act immediately without verification.

Common Urgency Tactics

• "Your account will be closed in 24 hours" — Real companies give you more time and multiple warnings
• "Suspicious activity detected—verify now!" — Banks have proper fraud departments; they don't operate via email links
• "You've won a prize—claim immediately!" — If you didn't enter a contest, you didn't win
• "Action required or lose access" — Legitimate services notify you repeatedly through multiple channels
• "Tax refund waiting—update your information" — The IRS communicates via postal mail, not email
• "Package delivery failed—confirm address" — Delivery companies retry deliveries; they don't need your email confirmation

The Truth: Legitimate companies want to keep you as a customer. They don't threaten account closure via a single email. Real urgency comes with phone calls, letters, and multiple touchpoints—never just one email.

Step 4: Examine Grammar, Design, and Personalization

Professional companies employ writers, designers, and proofreaders. Their emails are polished. Phishing emails often contain subtle (or obvious) flaws.

Signs of a Fake Email

Grammar and spelling errors:

• Typos in prominent places like subject lines or buttons
• Awkward phrasing that sounds like bad translation
• Inconsistent capitalization or punctuation
• Wrong verb tenses or articles (a/an/the)

Poor design quality:

• Blurry or low-resolution logos
• Misaligned text or images
• Inconsistent fonts or colors
• Broken formatting on mobile devices

Generic greetings:

• "Dear Customer" instead of your actual name
• "Dear User" or "Dear Member"
• "Valued Client" without specifics

Note: Real companies you do business with usually have your name and use it. However, sophisticated phishing emails may also have your name if scammers obtained it from data breaches, so this alone doesn't guarantee legitimacy.

Step 5: Be Wary of Attachments

Email attachments can contain malware that infects your computer the moment you open them. This is especially true for certain file types.

Dangerous Attachment Types

• .exe, .bat, .cmd, .scr — Executable programs that can run malicious code
• .zip or .rar — Compressed files that may contain hidden malware
• Office documents with macros — .doc, .xls, .ppt files that prompt you to "enable macros"
• PDF files from unknown senders — Can contain malicious scripts

Step 6: Verify Through Official Channels

When an email asks you to take action—update payment information, verify your identity, confirm a purchase—never use the links or contact information in the email itself.

Safe Verification Process

1. Don't click any links in the email
2. Open a new browser window or tab
3. Type the company's website address yourself (or use a bookmark you previously saved)
4. Log in to your account directly on the official website
5. Check for messages or alerts in your account dashboard
6. Or call the company using the phone number on your card, statement, or their official website (not a number from the email)

Example: You receive an email saying "Your Amazon package couldn't be delivered." Instead of clicking the link in the email, open Amazon.com directly in your browser, log in, and check your orders page. If there's really an issue, it will show there.

What To Do If You Clicked a Bad Link

If you realize you clicked a suspicious link or entered information on a fake website, act immediately. Speed matters.

Immediate Actions

1. Disconnect from the internet — Turn off WiFi or unplug your ethernet cable to prevent malware from spreading or communicating
2. Don't enter any more information — Close the browser tab or window immediately
3. Run a security scan — Use your antivirus software to scan for malware. If you don't have antivirus, disconnect and call a tech-savvy family member
4. Change passwords — For any accounts that used the same email/password combination, change your passwords from a different, clean device
5. Contact your bank — If you entered credit card or banking information, call your bank immediately and explain what happened. They may freeze your account and issue new cards
6. Monitor your accounts — Check your bank statements, credit card statements, and credit reports for unauthorized activity
7. Report the phishing email — Forward it to the Federal Trade Commission at spam@uce.gov and report it at ReportFraud.ftc.gov

Real-World Phishing Email Examples

Example 1: Fake Amazon Order Confirmation

Red flags:

• Sender domain is amazon-order-security.com, not amazon.com
• Generic "Dear Customer" instead of your name
• High-dollar amount to create panic
• Urgent call to action to make you click without thinking
• Real Amazon emails come from @amazon.com and show your actual name

Example 2: Fake Bank Alert

Red flags:

• Sender uses .net instead of Bank of America's real domain (bankofamerica.com)
• Creates fear with foreign location and account suspension threat
• 24-hour deadline to pressure immediate action
• Real fraud alerts let you call the bank; they don't require email verification

Example 3: Fake IRS Notice

Red flags:

• IRS domain is irs.gov, not irs-gov.org
• The IRS never notifies refunds via email—only postal mail
• IRS doesn't need you to "claim" refunds via email links
• Generic greeting "Dear Taxpayer"
• False urgency with 48-hour expiration

Advanced Phishing Tactics to Know

Business Email Compromise (BEC)

Scammers research executives and employees on LinkedIn, then send emails pretending to be the CEO or manager requesting urgent wire transfers or confidential information. These are highly targeted and personalized.

Lookalike Domains

Scammers register domains that look nearly identical to real ones: rn (two letters) instead of m, 0 (zero) instead of O, or adding/removing a hyphen. Example: paypa1.com looks like paypal.com at a glance.

Compromised Accounts

Phishing emails sent from a real person's hacked email account. The sender address is legitimate, but the account is controlled by scammers. Always verify unusual requests even from known contacts.

Frequently Asked Questions

Can my email account get hacked just by opening a phishing email?

No. Simply opening an email (without clicking links or downloading attachments) is generally safe. Modern email clients block most email-based attacks. The danger comes from clicking links or opening attachments, which can install malware or take you to fake login pages.

Should I click "unsubscribe" on spam emails?

No. Clicking "unsubscribe" in a phishing email confirms your email address is active, leading to more spam. Only unsubscribe from legitimate companies you recognize and have done business with. For suspicious emails, just delete them or mark them as spam.

What if I already entered my password on a fake website?

Change your password immediately on the real website. If you use the same password on other sites, change those too. Enable two-factor authentication wherever possible. Monitor your account for suspicious activity. Consider using a password manager to create unique passwords for every site.

How do scammers get my email address?

Email addresses are bought and sold in bulk from data breaches, scraped from public websites and social media, stolen from compromised contact lists, or generated by automated programs that try common name combinations. Having your email leaked doesn't mean you did anything wrong.

Can scammers fake any email address?

Scammers can spoof the "From" field to make it appear to come from any address, but email authentication protocols (SPF, DKIM, DMARC) help email providers detect this. That's why hovering over the sender name to see the actual address is crucial—the display name can be faked easily, but the real routing address reveals the truth.

Final Thoughts

Email verification is a skill that becomes automatic with practice. The 30 seconds you spend checking sender addresses and hovering over links can save you thousands of dollars and countless hours of stress dealing with identity theft and fraud.

Remember these core principles: Legitimate companies don't create artificial urgency, they never ask for passwords via email, and they provide multiple ways to verify their identity. When something feels off, it usually is. Trust your instincts and verify independently.

Bookmark this guide and share it with family members who might be targeted by phishing emails. The more people who know these verification techniques, the harder it becomes for scammers to succeed.