How to Tell If an Email Is Really From the Sender

To tell if an email is really from who it says, ignore the name at the top, look at the real address, and then confirm the request in a different way. The name shown on an email can be anything the sender types. The only check you can trust is one that does not depend on the email itself.

Here is a method you can do in under a minute, on a phone or a computer.

Display name versus address

Every email has two parts at the top. The first is the display name, for example "Your Bank Support". The second is the address inside angle brackets. The display name is free text. Anyone can set it to any words, including the name of your boss.

Many mail programs, especially on phones, show only the display name. That is why a fake can look perfect. The sender wrote "Anna Keller, Finance Director" and your phone showed exactly that.

The address has two sides. The part before the @ sign is a mailbox name. The part after it is the domain, and the domain is what matters. A real message from your bank comes from the bank's own domain. A message from a free personal mail service, or from a domain with an extra word or a changed letter, is not from the bank.

Looking at the real address on a phone

On most phones, you can see the full address by tapping the sender's name or the small arrow near it. In some apps you must press and hold the name. Do this before you read the rest of the message.

Now read the domain slowly, from right to left. Look for these small tricks:

A changed letter. A lowercase "l" swapped for a capital "I", or "rn" used in place of "m".
An extra word. The real company is "example.com" and the fake is "example-support.com" or "example.com.mailservice.net". Only the part just before the final ending counts.
A free mail address. A company message from a free personal address is a warning.
A close match to a colleague. The fake looks like your manager's name but sits on a domain you have never seen.

A good habit is to look at the domain every time, even when the email looks fine. Then it costs nothing when it matters.

Reply-to, links and attachments

Three more places can lie.

Reply-to. An email can show one sender but send your reply to a different address. If you press reply and the address in the "To" box is not the one you expected, stop. Some mail programs show this, and some hide it.

Links. The words of a link can say one thing while the real destination is another. On a computer, hover over the link and read the address at the bottom of the window. On a phone, press and hold the link to see its destination without opening it. Better still, do not use the link at all. Open the website or app yourself.

Attachments. Do not open a file you did not expect, even from a known name. A file that asks you to "enable editing" or "enable content" deserves extra care.

Check through a channel you already trust

This is the step that really settles it. A criminal controls the email. They do not control your phone book, or the bank website address you already know.

If the email asks you to do something, such as pay, share a code or open a file, confirm it another way:

Call the person on a number you already have, not a number in the email.
Or send a fresh message to them in your normal chat app.
For a company, open its website by typing the address yourself, or use its official app, and look for the same message there.

Say an accounts clerk, Mehmet, gets an email that appears to be from his manager. It says: "I am in a meeting. Pay this invoice today and tell nobody." The display name is right. The domain has one extra letter. Mehmet does not reply. He calls his manager on the desk number he has used for years. His manager has sent nothing. Mehmet forwards the email to the security team and does not delete it, so they can study it.

That small call took one minute and saved a payment.

Reporting it

If an email is a fake, report it. At work, use your employer's report button or forward it to the team they name. At home, most mail services have a "report phishing" option. Reporting helps the service block the same message for other people.

If you are not sure, report it anyway. Nobody is blamed for reporting a real message that looked strange. Delay is the thing that causes trouble. For more on spotting all kinds of scams, see our guide how to spot a scam email, text or call.

If a message arrived by text and talks about a parcel, read the package could not be delivered scam. If an email sends you to a sign-in page, see how to spot a fake login page.

When this does not work

Some fakes pass every check on the surface. If an attacker has really taken over a colleague's mailbox, the email comes from the true address and from the true domain. The domain check will pass, and so will the reply-to check.

That is why the last step matters most. Confirm any request about money, passwords, codes or private files through a second channel, whoever it seems to come from. If the request is unusual for that person, treat that as a reason to ask, not a reason to feel rude.

Also remember that your employer may have a set rule, such as "payment changes need a phone call". Follow it every time, even for a person you trust.

Learn this in five minutes

The track "Suspicious Messages" teaches you to pause before you click, check who really sent a message, treat urgency as a warning, handle links and files with care, and report what you find. Each lesson takes about five minutes and ends with a short practice.