Is That Email a Scam? Verify the Request Without Using Its Links

1. Separate the claim from the proof

An email may claim that a payment failed, your account will close, a package cannot be delivered, or a colleague needs an urgent purchase. Those claims create pressure to act. The safe first task is verification, not deciding quickly whether the design looks professional.

Expand the sender details and read the full address. A display name can say almost anything. Watch for a changed domain, an unrelated reply-to address, or an unusual request from an otherwise familiar account. Even a real account can be compromised, so an expected-looking address is one clue rather than a guarantee.

1. Do not use the email’s phone number to verify the email itself.
2. Do not reply just to ask whether a suspicious sender is genuine.
3. Do not forward a potentially harmful attachment to friends to get their opinion.

2. Verify using a separate route

For an account warning, use a bookmark, the installed official app, or an address you already know. Check account notifications, orders, or billing there. If the claimed problem does not appear, contact the company through its own published support channel.

For a request from a friend, relative, or coworker, use your usual phone number or an established conversation. Confirm unusual payment instructions through that channel, especially if the message asks you to keep the request secret or says the person cannot speak.

Hovering over a link on a desktop can reveal a mismatch, but it is not a complete safety check. Long addresses, redirects, and look-alike characters can be confusing. You do not need to click a link in order to verify the claim.

3. Recognize requests that deserve extra caution

Requests for gift cards, cryptocurrency, remote-access software, security codes, or a change to bank-payment details need independent verification. A job offer that asks you to buy equipment from a specified stranger is another reason to stop and investigate.

Grammar is a weak test. Legitimate messages sometimes contain mistakes and fraudulent messages can read perfectly. The useful questions are whether you expected this contact, whether the request fits the relationship, and whether the claim can be confirmed outside the email.

4. Report through your mail service

Use the mail provider’s Report phishing or Report spam control when appropriate. In Gmail on a computer, the message’s menu next to Reply contains Report phishing. Follow your employer’s reporting process for work mail; its security team may need the original message.

Do not use an unsubscribe link in a message you believe is fraudulent. A legitimate newsletter you knowingly joined is different; use the mail service’s unsubscribe feature or the verified sender’s preferences when you want to stop that subscription.

1. After reporting, remove the message from your inbox according to your provider or workplace process.
2. If you need a record for a support or fraud report, preserve it safely without opening attachments or publishing personal information.

5. Match the response to what happened

If you only read the email, you may not need to change every password. If you clicked a link but entered nothing, close the page and consider whether a download or permission request followed. If a file downloaded, do not open it. Use trusted security tools if software ran or suspicious activity appeared.

If you entered a password, change it through the real service from a trusted device, review active sessions and recovery details, and enable stronger sign-in protection. Change reused passwords on other accounts too. If you shared payment or banking information, contact the provider promptly using its official app or the number on your card.

For a work account, report the action to IT quickly and describe exactly what you clicked, entered, installed, or approved. Accurate detail helps recovery. Do not pay a cleanup provider promoted by the same message.