How to spot a fake email address in seconds

A legitimate email address follows a specific format: a username, an @ symbol, a domain name, and a top-level domain like .com or .org. But format alone does not tell you whether the address actually exists or belongs to who claims to own it. The real test is whether the email came from where it says it came from, and whether responding to it will reach a real person or a scammer's inbox.

The fastest check is to look at the sender's address in the email header — not the display name. Scammers often use a friendly name like "PayPal Support" but hide a completely different address in the actual "from" field. If the address does not match the organisation it claims to represent, it is fake. A real PayPal email comes from an address ending in @paypal.com, not @paypa1.com or @paypal-support.net.

Key Takeaways

  • Check the actual sender address in the email header, not just the display name — scammers hide fake addresses behind familiar names.
  • Real company emails come from the company's own domain (like @amazon.com), never from Gmail, Yahoo, or a lookalike domain with a typo or extra word.
  • Hover over links in the email to see where they actually point before you click — the visible text often lies about the destination.
  • If you doubt an email, contact the company directly using a phone number or website you find yourself, never using contact information from the email itself.
  • No legitimate company will ask you to confirm passwords, Social Security numbers, or payment details by email or link.

The difference between a display name and a real sender address

Every email has two "from" fields. The display name is what you see in your inbox — it can say anything. The actual sender address is what matters, and it is hidden unless you look for it. In Gmail, click the down arrow next to the sender's name. In Outlook, right-click the sender and choose "View Message Details". In Apple Mail, go to View and select "Show All Headers".

Once you see the real address, check whether it matches the organisation. Amazon emails come from @amazon.com addresses. Your bank uses its own domain, not a generic email service. If the real address is something like support@amazonservices-help.net or noreply@amazon-account.gmail.com, it is fake. Scammers buy domains that look similar to the real thing — amazonservices.net instead of amazon.com, or add words like "support" or "verify" to make it sound official.

Why domain names matter more than the username part

The part before the @ symbol (the username) can be anything. The part after the @ (the domain) is what proves legitimacy. A real company owns its domain and controls all email addresses that use it. If you see an email from paypal.support@gmail.com, that is not PayPal — it is someone using Gmail with a username that sounds official.

Legitimate companies almost never send important messages from free email services like Gmail, Yahoo, or Outlook.com. They use their own domain because it proves they are who they say they are. If your bank, your credit card company, or your employer sends you an important message, it comes from their own domain. Anything else is either a mistake or a scam.

How to check where a link actually goes

Scammers hide fake links behind real-looking text. An email might say "Click here to verify your account" but the link actually points to a fake website designed to steal your password. You can see the real destination without clicking: hover your mouse over the link (do not click) and look at the bottom left corner of your screen. The actual URL appears there.

If the visible text says "amazon.com" but the URL shows something different, do not click. If the URL has a typo (amaz0n.com instead of amazon.com), do not click. If you are unsure, close the email and go to the company's website directly by typing the address into your browser yourself. That way you know you are on the real site, not a fake one the email tried to trick you into visiting.

Red flags that an email address is not legitimate

Certain patterns almost always mean an email is fake. Watch for addresses with numbers replacing letters (amaz0n instead of amazon, or l1nkedin instead of linkedin). Watch for extra words added to a real domain (amazon-verify.com, paypal-security.net). Watch for misspelled versions of common domains (gmial.com, yahooo.com). These are deliberate tricks designed to fool you at a glance.

Also be suspicious of generic greetings like "Dear Customer" or "Dear User" instead of your actual name. Real companies have your name in their systems and use it. Scammers send the same email to thousands of people and cannot personalise it. Similarly, if the email asks you to confirm sensitive information — your password, your Social Security number, your credit card number, your PIN — through a link or by replying, it is fake. No legitimate company asks for that information by email.

What to do if you are not sure

The safest move is to contact the company directly using information you find yourself, not information from the email. If you get an email claiming to be from your bank, hang up if you are on the phone, close the email, and call your bank's customer service number from the back of your debit card or from their official website. Tell them you received an email and ask whether it is real. They can tell you when ready.

Do not use any phone number, link, or email address from the suspicious message itself. Scammers sometimes include fake customer service numbers in their emails. Always go to the official website or use a contact number you already have. If the email is real, the company will have a record of sending it and can confirm that. If it is fake, they will tell you to report it and delete it.

How email verification actually works

Some services let you verify whether an email address exists without clicking any links. You can use a free email verification tool like Hunter.io or RocketReach to check whether an address is real — these tools query the mail server to see if the address accepts mail. But this only tells you the address exists; it does not tell you who owns it or whether the person using it is trustworthy.

For personal safety, this technical check matters less than the context check. Does the email ask you to do something you were not expecting? Does it create pressure or urgency? Does it ask for information you would never give out? Those questions matter more than whether the address technically exists. A real address can still be used by a scammer, and a fake address is always a scammer.

Frequently Asked Questions

Can I trust an email just because it has a company logo?

No. Logos are straightforward to copy and paste into an email. Scammers steal logos from company websites all the time. The only thing that proves an email is real is the sender's actual email address — the one in the "from" field when you look at the full header. A logo proves nothing.

What if the email address looks perfect but I still feel suspicious?

Trust that feeling. Contact the company directly using a phone number or website you find yourself. If someone is asking you to do something unusual — click a link, confirm information, pay money, or act fast — it is worth a five-minute phone call to verify. Real companies understand this and will not be offended.

Is it safe to reply to an email to ask if it is real?

No. If the email is fake, replying confirms to the scammer that your address is active and monitored, and they will send you more scams. If the email is real, the company probably has a better way to reach them anyway. Always contact them through a phone number or website you find yourself.

Do I need special software to check if an email is real?

No. You only need to look at the sender's actual address in the email header and check whether it matches the organisation. You can do this in any email program in under a minute. If you are unsure, call the company. No software is necessary.

What should I do if I already clicked a link in a suspicious email?

If you only clicked the link and did not enter any information, you are probably fine — just close the page. If you entered a password, change it when ready on the real company website. If you entered payment information or your Social Security number, contact the company and consider placing a fraud alert with the three credit bureaus (Equifax, Experian, and TransUnion).