How to Spot a Phishing Email: What to Check First
Updated:
An unexpected email can deserve a closer look even when its spelling, logo and sender name look convincing. Verify the request independently before sharing information.
Start with the request
Ask what the message wants you to do. Is it asking you to sign in, disclose a code, open an unexpected file or make a payment? A familiar name is useful context, but it does not establish who sent the request.
If you want an explained second opinion, create a free account for online checks, then open the homepage checker. Use a fictional example first; remove passwords, verification codes and private details from anything you submit.
Check the sender without treating one detail as proof
Expand the sender details in your mail app. Compare the complete address with the organization you expected, including spelling and the domain. A display name and profile picture can be copied.
Some mail apps show authentication information. Gmail documents how to inspect its security details. Missing authentication is a reason for caution, but can also affect legitimate mail. Authentication alone does not establish that the message or request is trustworthy.
A different Reply-To address can have a legitimate purpose, such as a support service, or deserve investigation. It is a clue to examine with the rest of the message, rather than a verdict by itself.
A fictional account-warning example
Imagine this text in an email:
Your account is on hold. Sign in at account-review.example to keep access.
The address is an illustrative .example domain, not a real service. The important questions are whether you expected the message, whether the request appears inside the real account and whether you can verify it independently.
Open the service through its official app or a website you already know. Check account notifications there. Do not use the contact details or sign-in link in the unexpected email as your only verification.
Common clues and their limits
- Urgency: a deadline can put pressure on you. It does not, on its own, prove fraud.
- Writing and design: mistakes can be clues, but polished text and familiar branding are not evidence of authenticity.
- Links: the visible label may differ from its destination. Preview a link where your mail app supports it, without opening it.
- Unexpected attachments: verify why the file was sent before opening it. Its name or extension alone does not establish safety.
- Sensitive requests: keep passwords, recovery phrases and one-time codes out of replies and checking tools.
For a worked URL example, read how to inspect a suspicious link. If an invoice asks you to change bank details, use the payment-change verification guide.
If you have already interacted
What happened next matters. Opening a message, opening a page, entering a password and downloading a file are different events. If you disclosed a password, use the service's official account-recovery and security options. If a download may contain harmful software, use updated device-security tools. Follow the relevant provider's reporting instructions.
ScamsShield reviews content for possible warning signs and explains its assessment. It does not authenticate the sender, establish that an attachment is harmless or guarantee that a reassuring result is correct.
Choose the next step
Create a free account, then try a fictional message in the homepage checker within your displayed allowance. Review the privacy information before submitting personal content. Optional paid features and their quotas are shown on Pricing.
Frequently asked questions
Does correct spelling mean an email is genuine?
No. Writing quality and branding do not authenticate a sender. Verify an important request through the service independently.
Can ScamsShield prove that an email is safe?
No. It can explain possible warning signs, but its assessment can be wrong and does not verify the sender's identity.
Can I try a check before creating an account?
Online checks require an account. Additional free-account checks and paid features have displayed limits. Do not submit passwords or verification codes.
Sources and review
Reviewed on 25 October 2026. Published by ScamsShield, the provider of the tools linked above. These sources are references, not endorsements of ScamsShield.