Guide
How to check if an email is genuine
1. The address, not the name
Display names are free text. Anyone can send as “Microsoft Account Team” or your managing director's name. Look at the address itself — the part after the @ — and read it slowly. Replacements for letters (rn for m), extra hyphens, and domains ending in something other than the real one are the signature of a lookalike.
2. Where a reply would go
A reply-to header that differs from the sender is a standard trick: the message appears to come from the real company while the conversation diverts to the attacker. Most mail clients hide it — it is visible in the message headers.
3. The age of the domain
A company that has traded for a decade does not email from a domain registered three weeks ago. Domain registration dates are public through WHOIS, and a young domain asking for a bank transfer is about as clear as this gets.
4. Where the links really go
Hover — or long-press on a phone — and read the destination. The anchors can say anything. Watch for a familiar brand name appearing in the subdomain or path rather than the domain itself: paypal.com.secure-login.example is not PayPal.
Open redirects are worth knowing about too: a genuine link on a genuine service that forwards you somewhere else entirely. The first domain being real proves nothing about the destination.
5. What is it asking you to do?
Genuine routine email rarely asks for anything urgent. The pattern to distrust is a message that wants one of four things: a payment to new details, a password, personal data, or speed.
If the answer to “what does this want from me?” is uncomfortable, the correct next step is not to inspect the email harder — it is to reach the person or company through a channel you chose, not one the email gave you.
When the signs are genuinely absent
Sometimes a fake email is simply well made. Nothing in the text gives it away, the domain is real, and the thread is real — because the account behind it was taken over.
This is why the last check is behavioural rather than technical: for anything involving money or credentials, verify out of band. A thirty-second phone call settles what an hour of scrutiny cannot.
Questions
How can I tell if an email address is real?
Look at the full address rather than the display name, check whether the domain matches the organisation exactly, and check when that domain was registered. A recently registered domain, or one that imitates a real name with small changes, is unlikely to be genuine.
Can a genuine email address send a fake message?
Yes. If the real account has been taken over, the message comes from the correct address and sits in the correct thread. In that case only a separate verification channel — a phone call on a known number — will reveal it.
What is the single most useful check?
What the message wants you to do. If it wants money, credentials or urgency, verify it out of band regardless of how convincing the email looks.
Check a message before you act
If you have a message in front of you and you are not sure, paste it into Globosafe. You get a verdict — genuine, suspicious or fraudulent — with the specific warning signs and what to do next. Check a message.