How Do I Tell If an Email Is a Scam?

Scam emails have improved. The obvious ones with misspellings and foreign princes still exist, but the ones that work are clean, well-designed, use the right logos, and arrive at a plausible moment. The checks below still catch nearly all of them, because the scam has to do a few things that a genuine message never does.

The five checks

1. Is there pressure to act now? “Your account will be suspended in 24 hours.” “Unusual activity, verify immediately.” “Final reminder.” Urgency is the scam’s engine, because it stops you thinking. Real organisations rarely need you to do anything in the next hour.

2. Does the sender address match? Not the display name, which anyone can set to “HMRC” or “Amazon”, but the actual address after it. A message from a bank sent from a Gmail address, or from a domain that is almost right, such as amaz0n or hmrc-refunds, is a scam. Tap or click the sender’s name to reveal the address.

3. Where does the link actually go? Hover on a computer, press and hold on a phone. The destination should be the organisation’s real domain. Scam links point somewhere else, often hidden behind a shortener or a subdomain such as paypal.secure-login.example.

4. What is being asked for? A password, a PIN, a card number, a code you were just sent, a payment to a new account, gift card codes. Genuine organisations do not ask for passwords or codes by email, ever. A supplier changing their bank details by email is the single most expensive scam in business.

5. Is it addressed to you? “Dear customer” from a company that knows your name is a mild signal. Not conclusive, but it adds up.

The mismatch that gives most of them away

Scams need you to click their link. So the message is designed around the link, and everything else, the logo, the tone, the footer, is decoration. Ignore the decoration and look at two things: the sender’s real address and the link’s real destination. When either does not match the organisation claimed, that is the answer.

The safest response

Do not click anything in the email. If it claims to be from your bank, your delivery company or a service you use, open the app or type the address into your browser yourself and check there. If there is a real problem, it will be visible. If there is not, the email was the problem.

This one habit defeats nearly every phishing attack, because it removes the email from the process entirely.

If you already clicked

• Opened a page but entered nothing: close it, and run a security scan if on a computer.
• Entered a password: change it now on the real site, and everywhere else you used it. Turn on two-factor authentication.
• Entered card details: call your bank using the number on the card.
• Downloaded an attachment: disconnect from the internet and run a full scan, or take the device to someone who can.

Reporting

In the UK, forward phishing emails to report@phishing.gov.uk. The National Cyber Security Centre uses reports to take down the sites, and it works: hundreds of thousands of scam sites have been removed through the scheme. Suspicious texts go to 7726.