A familiar name in your inbox can make a message feel safe before you have checked who sent it. But display names are easy to copy, and an address that looks nearly right can point to a different domain. Before opening an attachment, sharing information, or acting on a request, compare the full sender address with what you expected. Then consider whether the request itself makes sense. These checks can help you notice warning signs, but no single address check can establish that a message or the account behind it is trustworthy.
The useful bits
- Expand the sender details and inspect the complete address, not just the display name.
- Compare the domain carefully with a trusted address you already have.
- Confirm unusual requests through a separate, known channel before acting.
Reveal the address behind the name
Start by opening the message details that show the sender’s full email address. The exact control varies by mail app, but look for the address associated with the From field rather than relying on the large name shown in the inbox. If the message also shows a reply address, inspect that too: a reply may be directed somewhere different from the address you expected.
Compare the complete address with a reference you trust, such as an earlier message you independently know is genuine or contact details obtained through a separate, established route. Check the part after the @ sign especially carefully. A familiar-looking name before the @ does not make an unfamiliar domain legitimate.
- Read the whole address, including the domain ending.
- Check whether the reply destination differs from the sender.
- If the details are hidden or unclear, pause instead of guessing.
Look for small domain changes
Lookalike addresses may replace a character, add a word or punctuation mark, or use a different ending. A hyphen, extra letter, or altered spelling can be hard to notice at a glance. Some characters from different writing systems can also resemble familiar letters. Slow down and compare the address character by character with the one you expected.
Do not assume that an address is valid because it contains a company or person’s name. For example, a message claiming to be from a supplier may come from a domain that includes the supplier’s name alongside unrelated words. Treat any unfamiliar variation as a reason to verify, not as proof of fraud by itself.
Expected contact: [accounts]@example.com Message display name: Example Accounts Full sender address: [accounts]@example-support.com What to notice: The domain is example-support.com, not example.com. Pause and verify the sender before using the message’s instructions.
Judge the request as well as the address
A correctly spelled address does not tell you whether the person intended to send this message, whether their account is under someone else’s control, or whether the message content is safe. Treat an unexpected request for a password, one-time code, payment, gift card, sensitive file, or urgent change to payment details with particular care.
Consider the context. Were you expecting this message? Does the request fit the sender’s usual responsibilities and the conversation so far? Does it pressure you to skip normal approval or keep the request secret? A familiar tone or accurate details can be copied or obtained elsewhere, so they do not replace verification.
Verify out of band
For an unusual or consequential request, contact the person or organisation using a channel you already trust—not contact details supplied only in the questionable message. You might use a known phone number, an established internal contact method, or an address from a reliable earlier record. Ask whether they sent the message and whether the specific request is genuine.
Do not simply reply to the email to check it; that may reach the same unverified sender. Likewise, avoid calling a number or following a sign-in link provided in the message until you have confirmed it independently. If you cannot verify the request, wait and follow your normal process rather than acting under pressure.
Message asks: “Please update our payment details today.” Safer next step: Contact the known accounts contact using the number or channel already on file. Ask them to confirm the request and the details before making any change.
A quick check before you act
Use this short sequence when a display name looks familiar but something feels off. It is a pause-and-check routine, not a guarantee that a message is safe. Keep the original message available so you can compare its sender details with the information confirmed through your separate channel.
- Open sender details and read the full From address and any reply address.
- Compare the domain and spelling with a trusted reference; note even small differences.
- Assess the request, its urgency, and whether you expected it.
- Verify unusual requests through a known, separate channel before taking action.
Know what a successful check means
You have completed the address comparison when you can identify the full sender address, state how its domain matches or differs from the reference you expected, and check whether replies go where you think they should. For a request that needs verification, confirmation means the person or organisation independently confirms that particular request—not merely that the address looks familiar.
Even when both checks line up, keep using ordinary caution with links, attachments, and sensitive information. An address match is one useful clue, not proof that the message or account is trustworthy. If the sender cannot be confirmed or the request remains unusual, do not proceed based only on the email.
About this guide
Prepared with AI assistance for the BITTU Mail editorial library. Check important details against your original messages and current account settings. Product access depends on your role, plan and provisioning state. Provider interfaces and requirements can change.
View current plans · Security information · Suggest a correction