Member guide · Read a preview, full guide with Personal

How to tell if an email is a scam (before you click anything)

Got an email about a billing problem, a refund or a locked account? Nine practical checks to tell a scam email from a real one, and what to do if you already clicked.

Scam emails work because they look like something you expect: a bank alert, a delivery notice, a subscription renewal. The FTC says phishing emails “often tell a story to trick you into clicking on a link or opening an attachment” (FTC). The good news is that the story usually gives them away, if you slow down for a minute.

The 9 checks

  1. Do you actually have an account with them? The FTC’s first question: if you don’t have an account with the company or know the person, it could be phishing (FTC).
  2. Look at the real sender address. Tap or hover on the sender’s name. “PayPal Support” sent from a random Gmail address or a domain like paypal-billing-help.com is a red flag.
  3. Is the greeting generic? “Dear customer” instead of your name is one of the signs in the FTC’s example.
  4. Does it say something is wrong with your account? Suspicious log-ins, billing problems or “confirm your details” are the most common stories (FTC).
  5. Is there an invoice you don’t recognise? The FTC says these are fake. Don’t call the phone number on it.
  6. Does it ask you to update payment details through a link? The FTC says legitimate companies won’t email or text you a link to update payment information.
  7. Is there a deadline or a threat? “Within 24 hours or your account will be closed” is pressure, not service.
  8. Check the link without clicking. On a computer, hover over it and read the address that pops up. On a phone, press and hold. If the domain isn’t the company’s real one, stop.
  9. Unexpected attachment? Attachments can install malware (FTC). Don’t open them unless you were expecting the file.

Unlock the full guide with ImposterWatch Personal, US$9/mo

Members read every guide in full, plus get breach and dark web alerts for up to three email addresses, an AI-powered romance scam check every month, and account recovery help.

Get Personal, US$9/mo Already a member? Log in

Not ready? Get free scam alerts

Signing up doesn’t unlock this guide. See our privacy policy.

How to check it properly

Close the email and go to the company yourself: type the web address you know, or use the official app, or ring the number on your card or statement. If there really is a problem, you’ll see it there. The UK’s National Cyber Security Centre gives the same advice (NCSC).

For a closer look at sender domains and headers, see how to check if an email is really from a company.

What to do if you already clicked or replied

  • If you typed a password, change it on the real site and turn on multi-factor authentication.
  • If you gave card or bank details, call your bank on the number on your card.
  • If you gave your Social Security number or other ID (US), follow the steps at IdentityTheft.gov.
  • If you opened an attachment, update your security software and run a full scan (FTC).

Where to report scam emails

Helping a parent? Set up their email so the full sender address shows, and agree on one rule: no clicking links in emails about money. Check with you first.

Questions

The email has the company’s real logo. Is it genuine?

Not necessarily. The FTC’s own example of a phishing email uses the company’s logo in the header. Logos are easy to copy.

I clicked the link but didn’t type anything. Am I OK?

Probably, but update your security software and run a scan, as the FTC advises. If you entered a password, change it straight away on the real site and turn on multi-factor authentication.

Can a scam email come from a real address?

Yes, if the sender’s account was hacked. That’s why you verify the request itself, not just the address.

Check before you waste your time

Run the free domain scan on the sender’s domain to see whether it’s set up like a real business and whether lookalike domains exist. ImposterWatch Personal (US$9/month, cancel anytime) adds AI-powered checks, breach alerts for up to three email addresses and account recovery help.

Run the free domain scanGet Personal, US$9/mo

More guides

General information only, not legal or financial advice. ImposterWatch is operated by Cloud Investments FZE (UAE) and is not a background check or private investigator service.