How to tell if an email is real or fake.

Quick answer. Read the sending domain character by character, check where the links actually go, and confirm anything about money or credentials through a channel you chose yourself. Never verify a suspicious email by replying to it.

Most fraud that reaches people begins in an inbox, and the convincing ones are not sloppy. They copy the real template, the real logo and the real tone. What they cannot copy is the domain, and that is where verification starts.

Read the address, not the display name

The display name is free text: anyone can send as "PayPal Support" or as your own company's finance team. Expand the actual address and look at the part after the @ sign.

Look for a swapped character — a digit standing in for a letter, "rn" reading as "m", an extra hyphen. Look for the real brand name as a subdomain of something else, which is the most effective trick of all: a domain that ends in a stranger's name still belongs to the stranger, whatever appears before it.

Check the top-level domain too. A bank that has always written from a .com does not switch to an unusual extension for one message.

Check where the links go

Hover a link on a desktop, or press and hold on a phone, and read the destination before it opens. The visible text is decoration; the destination is the fact.

Shortened links hide it entirely, which is reason enough not to follow one from an unexpected message. Same with QR codes in emails and letters — they are links you cannot read.

The safest habit costs nothing: when a message says something about your account, do not use its links at all. Open the app or type the address yourself. A real notice will be waiting for you there; a fake one will not exist.

Attachments and the quiet ones

Unexpected attachments are the old attack and still work: an invoice, a delivery note, a resume, a document that asks you to enable content. Enabling content is enabling code.

The quieter version skips attachments and asks a question — "are you at your desk?" — to start a conversation that ends in a gift-card purchase or a payment change. Plain-text messages with no links pass every filter precisely because there is nothing to scan.

The expensive one: changed payment details

Invoice fraud is where the real money goes. A supplier you know writes to say their bank details have changed, sometimes from a compromised mailbox that is genuinely theirs, with the correct history quoted underneath.

One rule prevents it: confirm every change of payment details by voice, on a number you already held — not one written in the email. Do it even when the request looks internal, and especially when it is urgent. Fraudulent requests are always urgent, because scrutiny is what they cannot survive.

What the headers can tell you

Every mail client can show the original headers, and two lines are worth reading: the authentication results, which say whether the message passed SPF, DKIM and DMARC for the domain it claims, and the return path, which is often a different domain entirely.

Passing authentication does not make a message honest — a fraudster's own domain passes for itself — but a failure on a message claiming to be from a large company is close to decisive.

Check the person or business behind the address

For an unfamiliar business contact, the question is whether the organisation exists as described: a registration record, an address, a phone number you can find independently rather than one supplied in the message. Verifying a business contact covers that sequence.

For an individual, a name is what can be checked. Recordwell searches by first and last name and holds no email or phone data at all, so it will not tell you who owns an address — what it will do is show whether the person named has a record history consistent with the story. A people search is the starting point, and matching records to the right person explains what counts as confirmation.

If you clicked or replied

Change the password for the account involved, from a different device if you can, and sign out of all sessions. Then check the account's recovery details and forwarding rules — a quiet forwarding rule is how a compromised mailbox keeps leaking after the password changes.

If card or bank details went in, call the issuer and ask for the card to be reissued. If work systems are involved, tell your IT team immediately; the cost of an early report is nothing compared with a week of silent access.

Report phishing to the FTC at ReportFraud.ftc.gov, and forward the message to the impersonated company — most large brands publish an abuse address and act on them.

Key takeaways

Three checks cover almost everything: the real domain, the real link destination, and an independent channel for anything involving money or credentials.

Urgency is the common thread across every variant. A message that insists there is no time for verification is telling you exactly what verification would reveal.