Is This Email a Scam? How to Check the Sender

You're staring at an email. Maybe it says your account is locked. Maybe there's an unpaid invoice, a parcel stuck in customs, or a bonus waiting for you. Something feels off — but it also looks just real enough to make you hesitate. That hesitation is exactly what scammers engineer for.

A short review can surface warning signs without claiming certainty about the sender. This guide explains common phishing red flags, how to review the visible sender address and technical headers, what public-source context may support, and what to do if you have already clicked.

The Red Flags That Give Scam Emails Away

No single sign or fixed number of signs proves that a message is fraudulent. Treat several warning signs as a reason to pause and verify important claims through an official channel you find independently.

1. Urgency and threats

"Your account will be suspended in 24 hours." "Final notice." "Unauthorized login detected — act now." Real companies rarely give you a ticking clock to hand over a password. Manufactured panic is the scammer's favorite tool because rushed people skip the checks they'd normally do.

2. The greeting is generic

"Dear Customer," "Dear User," or "Hello [your email address]" instead of your actual name. A company you truly have an account with usually knows your name. Note the reverse is also true now: scammers buy leaked data, so a message that does use your real name isn't automatically safe.

3. The ask is the giveaway

Legitimate organizations do not email you to ask for your password, full card number, a private security code, or payment in gift cards, crypto, or wire transfer. Any of those requests is a hard stop. The gift-card and crypto asks in particular are near-universal scam tells.

4. Links and attachments that don't add up

Hover your cursor over any link (on mobile, press and hold) and read the address that pops up before tapping. If the text says "paypal.com" but the real destination is "paypa1-secure.ru" or some random string, it's a trap. Unexpected attachments — especially .zip, .html, .iso, or anything asking you to "enable macros" — are classic malware delivery.

5. Small mistakes and odd formatting

Misspellings, broken grammar, a logo that's slightly the wrong color, or a layout that looks copy-pasted. AI has made scam writing cleaner than it used to be, so don't rely on typos alone — but they still show up, and they're still a tell when they do.

Check the Sender's Real Address, Not the Display Name

The single most useful move you can make is to stop reading the friendly display name and look at the actual address behind it.

Email lets the sender set any "From" name they want. "Apple Support," "Your Bank," "PayPal Service Team" — those are just labels, typed by whoever sent the message. The part that's harder to fake is the address after the @ sign.

• Tap or click the sender name to expand the full address. On Gmail, click the little down-arrow under the sender. On Apple Mail, tap the name. On Outlook, hover or open the message details.
• Read the domain — the part after the @. A real PayPal message comes from a paypal.com domain, not "paypal-billing.com," "paypal.secure-login.net," or "service@paypal.com.account-verify.ru." Scammers love to bury the real brand name as a subdomain in front of their own junk domain.
• Watch for look-alike characters. "rn" that reads as "m," a zero instead of an "o," or accented letters that mimic the real domain. When in doubt, type the address out and compare letter by letter.

If the display name claims a major company but the domain is a free mailbox (gmail.com, outlook.com, proton.me) or differs from the company's official domain, pause and verify the message through contact details you obtain independently.

Read the Headers for More Technical Context

The visible "From" address can still be spoofed. An email's headers contain authentication and delivery-path details that can add context, but they do not by themselves identify the human sender or prove whether a message is safe.

How to view them:

• Gmail: open the message → three-dot menu (top right) → "Show original."
• Outlook (web): open the message → three-dot menu → "View" → "View message source."
• Apple Mail: select the message → View menu → Message → All Headers (or Raw Source).

You don't need to decode every line. Look for three things:

• Return-Path / Reply-To: a different domain can justify caution, but legitimate mailing platforms, support systems, and forwarding can also create differences.
• Authentication results — SPF, DKIM, and DMARC: PASS, FAIL, and softfail results provide useful authorization context, but forwarding and configuration errors can affect them. They do not identify the human sender.
• Received lines: these record parts of the delivery path. An unfamiliar server or country can warrant independent verification, but it is not conclusive by itself.

Headers are useful technical evidence, not a truth guarantee. Interpret authentication and routing signals together, account for forwarding or misconfiguration, and verify important claims through an official channel.

Review Public Context and Its Limits

Headers provide authentication and routing context but do not identify the human sender. A public-source email report may add cited references, yet it cannot prove ownership, intent, or safety.

PrufAgent organizes supported public references tied to a submitted email and reports aggregate exposure status where available. Coverage can be thin or stale, and a candidate profile or missing result does not establish who controls the address.

What useful results look like:

• Supported public references can provide source-linked context, but age and consistency do not prove identity or legitimacy.
• A thin footprint may reflect privacy, a new address, blocked indexing, or limited coverage. It does not classify an address as genuine or disposable.
• Exposure checks are source-specific. Use Have I Been Pwned for historical breach notices; PrufAgent reports only supported aggregate infostealer exposure status.

PrufAgent reports supported public references and aggregate infostealer exposure status for email or username reports, while labeling thin or unsupported results. It does not identify a human sender or access private profiles or breach contents. For more context, see public email clues and their limits, reverse email lookup, and the email breach check.

What to Do With a Scam Email

Once you've decided a message is bad, handle it cleanly:

• Don't reply, don't click, don't unsubscribe. Even the "unsubscribe" link can confirm your address is live or load a malicious page. Just don't interact.
• Report it. In Gmail, use "Report phishing" (three-dot menu); in Outlook, "Report → Phishing." This trains your provider's filters and protects others.
• Mark as spam and delete. After reporting, get it out of your inbox.
• If it impersonates a company you use, verify through a channel you find yourself — type the company's real website into your browser or call the number on your card or statement. Never use the contact details inside the suspicious email.
• Forward phishing reports to your national reporting body if you want to help shut the operation down (for example, the Canadian Anti-Fraud Centre, or reportphishing@apwg.org internationally).

If you already clicked or entered something

• Stop and don't submit anything further on the page that opened.
• Change the password for any account you may have exposed — and any other account where you reused that password.
• Turn on two-factor authentication everywhere it's offered, so a stolen password alone isn't enough.
• Watch for follow-on scams. Once you bite once, your details get sold and resold. Expect more attempts and treat them with extra suspicion.
• Check source-specific exposure signals. A supported aggregate result can justify precautionary password and session steps, but it does not prove which credentials or devices were affected.

The Two-Minute Sniff Test

When a new email makes you pause, run it through this in order:

1. Does it push urgency, fear, or a too-good reward? Slow down.
2. Is the real domain after the @ exactly the company's own? Expand it and read it.
3. Where do the links actually go? Hover before you click.
4. Is it asking for a password, code, or payment? Legit senders don't.
5. Need more context? Review the headers and SPF/DKIM/DMARC results, then verify important claims through an official contact channel. A lookup cannot reveal who is really behind an address.

Most scams fall apart at step two or three. The ones that survive that far are exactly the ones worth checking the headers and running a lookup on. A scam wants you moving fast — your whole advantage is being willing to take two minutes.