Check the basic format first
A legitimate email address follows a simple pattern: a local part (the name before the @), the @ symbol, a domain name, a dot, and a top-level domain like .com or .org. If any of these pieces are missing or malformed, the address is not valid. For example, john.smith@company.com is properly formatted, but johnsmith@company or john.smith@.com is not.
Look for obvious typos or unusual characters. Real email addresses use letters, numbers, hyphens, underscores, and periods in the local part. Anything else — like spaces, asterisks, or multiple @ symbols — means the address cannot work. If you are reading an address aloud and it sounds awkward or you have to spell it out letter by letter, it may be fabricated.
The domain name (the part after @) should be a real company or service name. If someone claims to work for Apple but their email is @applesupport.net instead of @apple.com, that is a red flag. The official domain for a company is usually their main website address without the www.
Key Takeaways
- A real email address has a local part, @, domain name, dot, and top-level domain with no spaces or unusual characters.
- Check the domain against the company's official website — scammers often use domains that look similar but are slightly different.
- Verify suspicious addresses by contacting the organization directly using a phone number or website you find yourself, not one the email provides.
- Free email services like Gmail or Yahoo are legitimate for personal use, but companies usually have their own domain-based addresses.
- An address that passes format checks can still be fake if the sender's story does not match their email domain.
Compare the domain to the company's official website
The most common scam is a domain that looks almost right but is not. A sender might use @applesupport.net, @apple-security.com, or @appleid-verify.com when the real Apple domain is @apple.com. These fake domains are registered by scammers and designed to fool you at a glance.
Go to the company's official website yourself — do not click a link in the email — and look at the email addresses listed there. Check the contact page, the footer, or any staff directory. If the email you received does not match the domain you see on the official site, it is not from that company.
Be especially cautious with subdomains. A real company might use @support.company.com or @billing.company.com, but the part after the final dot should still be the company's actual domain. If you are unsure, call the company's main phone number (from their website, not the email) and ask whether the address is legitimate.
Watch for mismatches between the email and the message
A legitimate email from a company usually comes from an address that matches the company's name or department. If you receive an email claiming to be from your bank's security team but it comes from a Gmail address, it is not real. Banks, government agencies, and large companies have their own email systems.
Scammers often use free email services like Gmail, Yahoo, or Outlook to impersonate organizations. While individuals and small businesses legitimately use these services, a major company will not contact you about account issues from a free email address. If the sender claims to represent an organization but uses a personal email domain, treat it as suspicious.
Also notice whether the email address matches the sender's name. If the message says it is from "Sarah Chen at Customer Support" but the address is @randomletters.com or shows a completely different name, something is wrong. Real companies use consistent naming conventions.
Verify the address directly with the organization
When you receive an email asking for sensitive information — passwords, payment details, personal identification numbers — never reply to the email or click links in it. Instead, contact the organization using contact information you find yourself.
Call the company's main phone number (look it up on their official website or your statement), or log into your account through the official website and check for messages there. Ask whether the email address is legitimate and whether they sent the message you received. This is the only way to be certain.
If the email claims to be urgent or warns that your account will be closed, that is another sign it may be fake. Real companies give you time to respond and do not pressure you into acting immediately. Scammers use urgency to prevent you from thinking clearly.
Understand what makes a domain legitimate
A top-level domain is the suffix at the very end: .com, .org, .gov, .edu, .net, and many others. All of these can be legitimate. A .gov domain is always a real government agency because only government bodies can register .gov addresses. A .edu domain belongs to an accredited school or university.
.com, .org, and .net domains can be registered by anyone, so they are not a may provide of legitimacy on their own. A scammer can register @bankofamerica-security.com even though it is not the real Bank of America. The key is whether the domain matches the official company website.
Some newer top-level domains like .shop, .tech, or .online are also legitimate, but they are less common for business email. If a major company uses an unusual domain extension, verify it before trusting the address.
Check for common phishing and spoofing tricks
Phishing emails often use domains that are one character different from the real one. For example, @amaz0n.com (with a zero instead of the letter O) or @paypa1.com (with the number 1 instead of the letter L). These differences are easy to miss at a glance, especially on a phone screen.
Some scammers use display name spoofing, where the email shows a trusted company name in the "From" field but the actual email address is fake. Your email client may display "Apple Support <support@applesecurity.net>" even though the real address is not from Apple. Always check the actual email address in angle brackets, not just the display name.
If you are using Gmail, Outlook, or another major email service, check whether the email has a warning label. Gmail marks emails that fail authentication checks with a question mark icon next to the sender's name. This does not mean the email is definitely a scam, but it is a sign to be extra careful.
Frequently Asked Questions
Can a fake email address still pass a format check?
Yes. An address like scammer@legitimlooking.com is technically valid — it has all the right parts and no typos. Format checking only tells you whether the address could theoretically receive mail. It does not tell you whether the sender is who they claim to be. Always verify the domain against the official company website.
Is a Gmail address always fake if it claims to be from a company?
Not always. Small businesses, startups, and freelancers legitimately use Gmail for business. But major banks, government agencies, and large corporations will not contact you about account issues from a Gmail address. If you are unsure, contact the organization directly using a number or website you find yourself.
What should I do if I already replied to a suspicious email?
If you gave out sensitive information like a password or credit card number, contact the real organization immediately using a phone number from their official website or your statement. If you only replied with your name or email address, monitor your account for unusual activity and consider changing your password. Do not open any attachments or links the sender provides.
Do I need special software to check if an email is real?
No. You can verify an email address by comparing the domain to the company's official website, checking for obvious typos, and calling the organization directly. These steps are free and more reliable than most tools. Your email provider's built-in warnings are also helpful.
What if the email address looks real but I still feel unsure?
Trust your instinct. If something feels off — the tone is unusual, the request is strange, or the timing is suspicious — contact the organization directly before responding. A few minutes of verification is worth the protection against fraud.