Start with what the email is asking you to do

The fastest way to judge whether an email address is legitimate is to ignore the address itself and look at what the message wants from you. Real companies rarely ask you to confirm passwords, click links to "verify your account," or send money to an email address. If the email is asking you to do something that feels risky — especially something urgent — the address is probably fake, even if it looks official.

Scammers copy the look of real companies so closely that the email address itself can fool you. They might use addresses like support@amaz0n-help.com (with a zero instead of the letter O) or paypa1.verify@secure-login.com (with the number 1 instead of the letter L). Your eye skips over the difference in a hurry. The request inside the email — asking you to click a link and enter your password — is what tells you it is fake.

Key Takeaways

  • Legitimate companies do not ask you to confirm passwords or account details by email, no matter how official the message looks.
  • Check the full email address by hovering over the sender's name or looking at the message headers, not just the display name that appears in your inbox.
  • If you are unsure, go directly to the company's website by typing the address yourself — do not click any link in the email.
  • Phishing emails often ask you to act fast or warn that your account will close, creating pressure so you do not stop to think.
  • Your email provider's spam filter catches most fake emails, but some still get through, so your own judgment is the last line of defense.

How to see the real email address behind the display name

Email addresses have two parts: the display name (what you see in your inbox) and the actual address (what the message came from). Scammers control both. They can set the display name to "Amazon Support" or "PayPal" while the actual address is something completely different.

To see the real address, hover your mouse over the sender's name in Gmail, Outlook, Apple Mail, or Yahoo Mail. A small box will pop up showing the actual email address the message came from. If it does not match the company's real domain — for example, if it says noreply@amazonverify.net instead of something from amazon.com — the email is fake. You can also look at the message headers (usually under a "Show Original" or "View Message Source" option) to see the full path the email took.

Real companies use their own domain names in their email addresses. Amazon uses addresses ending in @amazon.com. Apple uses @apple.com. If the address ends in something else — even something that sounds official — it is not from that company.

Check the company's official contact information

If you are not sure whether an email is real, do not reply to it or click any links. Instead, go to the company's official website by typing the address yourself into your browser. Look for a "Contact Us" page or a phone number. Call them or use the contact form on their website to ask whether they sent you that email.

This step takes a few minutes but protects you completely. A real company will tell you whether the email came from them. If they say no, you know it is a scam. If they say yes, you can ask them what you should do next — usually they will tell you to ignore the email and contact them directly if you have account questions.

Keep a list of the real contact information for companies you use often: your bank, your email provider, your credit card company, your insurance company. When you get an unexpected email from any of them, check your list before you respond.

Red flags that signal a fake email

Certain patterns appear in almost every phishing email. Urgent language — "Your account will close in 24 hours" or "Confirm your identity now" — is designed to make you act without thinking. Real companies give you time to handle account issues. They do not threaten to shut you down unless you click a link immediately.

Spelling and grammar mistakes are another sign. A real company's official emails are proofread. If you see "Confirm you're account" or "Click here to reverify," the email is almost certainly fake. Scammers often work in other countries and use translation tools or write quickly, so errors slip through.

Requests for sensitive information are a hard rule: legitimate companies never ask for passwords, Social Security numbers, credit card numbers, or PIN codes by email. If an email asks for any of these, it is fake. Your bank will never email you asking to "verify your account number." Your email provider will never ask you to "confirm your password."

Generic greetings like "Dear Customer" or "Dear User" instead of your actual name are common in phishing emails. Real companies usually address you by name because they have your account information. If an email from your bank says "Dear Valued Customer," it is probably not from your bank.

What to do if you think you received a phishing email

If you realize you clicked a link or entered information into a fake email, act quickly. Change your password for that account right away — go directly to the company's website and change it there, not through any link in the email. Use a password you have never used before.

If you entered your credit card number, call your credit card company directly (use the number on the back of your card, not any number in the email). If you entered your Social Security number, consider placing a fraud alert with the three major credit bureaus: Equifax, Experian, and TransUnion. You can do this for free by calling 1-888-5-OPTOUT or visiting IdentityTheft.gov.

Report the phishing email to your email provider. In Gmail, click the three dots next to the email and select "Report phishing." In Outlook, click "Junk" and then "Phishing." In Apple Mail, you can forward the email to reportphishing@apple.com. These reports help the company's security team block similar emails from reaching other people.

How email providers filter out fake emails

Gmail, Outlook, Yahoo Mail, and Apple Mail all use automated systems to catch phishing emails before they reach your inbox. They look for known scam patterns, check whether the email came from a real company's servers, and flag messages that look suspicious. Most phishing emails never make it to your inbox — they go straight to spam or junk.

But no filter is perfect. Some fake emails get through because scammers constantly change their tactics. They use new domains, copy real emails more carefully, and exploit current events to make their messages seem urgent and real. This is why your own judgment matters: you are the final filter between a phishing email and your accounts.

Frequently Asked Questions

Can an email address look completely real but still be fake?

Yes. Scammers can buy domain names that look almost identical to real ones — for example, amaz0n.com instead of amazon.com, using the number zero instead of the letter O. The only way to be sure is to hover over the sender's name to see the actual address, or to contact the company directly using information from their official website.

What if the email came from someone I know?

Scammers can hack email accounts or spoof addresses to make it look like the email came from a friend or family member. If a message from someone you know asks you to click a link or send money, contact them through another method — call them, text them, or message them on social media — to confirm they actually sent it. Real people understand this check.

Is it safe to unsubscribe from a phishing email?

No. Clicking an unsubscribe link in a phishing email tells the scammer your email address is active and you read the message. They will send you more emails. Instead, mark it as spam or phishing and delete it. Your email provider will handle the rest.

Why do some fake emails have good grammar and look professional?

Scammers have gotten better at copying real company emails. They study official emails, use professional templates, and hire people who speak English well. The message itself — what it is asking you to do — is still your best defense. If it asks for a password or threatens to close your account, it is fake, no matter how polished it looks.

Can I trust an email just because it has the company's logo?

No. Logos are easy to copy. Scammers download them from company websites and paste them into fake emails. A real logo is not proof the email is real. Check the actual email address, look at what the message is asking you to do, and when in doubt, contact the company directly.