A suspicious email rarely announces itself clearly. A familiar name can appear on an unexpected request, while an unusual message may have an ordinary explanation. Instead of deciding from one clue, use the same short checklist each time: inspect the sender, check where a reply or link would go, consider the request, and look for context around attachments. Then verify important claims independently. The goal is not to label every message safe or fraudulent. It is to avoid acting while a meaningful detail is still unclear.
The useful bits
- Treat clues as reasons to check, not proof by themselves.
- Inspect the actual reply address and link destination before acting.
- Verify consequential requests through a separate, trusted channel.
Start with the sender, not the display name
Look at the full sender address and compare it with what you expected. A display name such as “Payroll” or “Sam” is easy to read, but it does not by itself establish who sent the message. Check the part after the @ sign, and notice small differences, extra words, or a domain that does not fit the claimed organization.
Also ask whether this person or organization would normally contact you about this subject. A mismatch deserves attention, but it is not a verdict: a legitimate sender might use a service provider or a different address, and an address that looks familiar does not prove the message is genuine.
- Sender’s full address: ____________________
- Expected sender and reason for contact: ____________________
- What, if anything, does not match? ____________________
Check the destination before you follow it
For a link, inspect its destination without opening it. On many devices, you can hover over a link to preview the address; on a touchscreen, use the available link preview rather than tapping through. Read the domain carefully. A link can use reassuring words while leading somewhere unrelated, and a short or unfamiliar address may be difficult to assess from its appearance alone.
For a reply, start a new message to the address you already have for the person or organization, rather than relying on the reply address in an unexpected email. Do not enter a password, payment detail, or one-time code just to discover whether a page is legitimate. If you cannot determine where a link leads, leave it unopened and verify another way.
Translate the request into a specific action
Write down what the message wants you to do: send money, change payment details, share information, sign in, approve something, or act before a deadline. Then ask whether you expected that request and whether its details fit the situation. Urgency, secrecy, or pressure to bypass a usual process are reasons to pause and check—not conclusive proof of fraud.
Pay particular attention to changed account or payment instructions. A message that sounds plausible can still contain a wrong amount, recipient, or deadline. Do not rely on a name in the message to confirm those details.
Give attachments a reason to be there
Ask whether you were expecting the attachment, who said they would send it, and whether the file type and subject make sense together. If a document arrives unexpectedly, contact the supposed sender through a number or address you already trust and ask whether they intended to send it. Avoid opening a file merely to find out what it is.
A security scan can be one useful check, but it cannot establish that every attachment is safe or that a particular file is harmless. An expected file can still need verification, and an unexpected file is not automatically malicious. When the context is missing, wait for clarification.
Verify important claims outside the message
Use a separate route you choose yourself: a saved phone number, a known website entered directly in the browser, or a new message to an address you already trust. Do not use contact details supplied only in the questionable email. Ask a precise question, such as whether the payment change was authorized or whether the attachment was sent.
For a consequential request, confirm the exact action and details—not just that the sender sent something. If you cannot reach the person or the answer is incomplete, do not proceed yet. Verification is useful when it resolves the uncertainty that mattered; an unanswered call or a vague “looks fine” does not settle a specific discrepancy.
Use the checklist without turning it into a verdict
Keep a note you can reuse. Mark each item “fits,” “unclear,” or “does not fit”; do not total the marks into a safety score. Several reassuring details do not prove a message is genuine, and one odd detail does not prove it is fraudulent. The decision point is whether an important question remains unanswered.
For example, suppose you receive a message from [sender@example.com] asking you to review a new invoice at [link]. The sender’s name is familiar, but you were not expecting an invoice and the previewed destination does not clearly match the organization. Leave the link unopened. Contact the organization using details you already have, ask whether the invoice and destination are theirs, and compare the answer with the request. If the details remain unclear, wait rather than signing in or paying.
PERSONAL MAIL CHECK Sender and full address: ____________________ Expected topic or contact: ____________________ Reply address or link destination checked: ____________________ Requested action and deadline: ____________________ Attachment expected, and why: ____________________ Independent contact used and what was confirmed: ____________________ Unresolved detail: ____________________ Decision: proceed only if the important details are clear; otherwise pause.
About this guide
Prepared with AI assistance for the BITTU Mail editorial library. Check important details against your original messages and current account settings. Product access depends on your role, plan and provisioning state. Provider interfaces and requirements can change.
View current plans · Security information · Suggest a correction