Is this email genuine? How can I tell?

Not every unexpected email is a scam. Real organisations send receipts, appointment reminders, delivery updates and newsletters every day. The aim is to check calmly, not to be suspicious of everything.

What is phishing?

Phishing is when someone pretends to be a person or organisation you trust to trick you into sharing information, clicking a harmful link or sending money.

Five useful checks

1. Look at the actual email address. A familiar display name can be faked. Expand the sender details to see the full address. A familiar address is helpful, but it is not proof on its own.
2. Were you expecting it? A receipt after a purchase makes more sense than a surprise warning about an account you don't have.
3. What does it ask you to do? Be particularly cautious about passwords, security codes, unexpected payments or installing software.
4. Is it pressuring you? Claims that you must act in minutes or keep something secret are warning signs.
5. Are the links and attachments expected? Instead of following a doubtful link, open the official app or type the website address yourself.

Good spelling, professional logos and a familiar sender name do not guarantee an email is genuine. Equally, an unusual-looking email is not automatically a scam.

All the examples on this page are fictional. Their email addresses are deliberately made up. Real scam messages can look different, and genuine messages can sometimes look unusual.

For next steps, see I clicked a link, I shared information, Someone got into my account or I sent money.

1. Stop before clicking or replying. You don't have to follow a deadline in an unexpected message.
2. Check another way. Open the official app or website yourself, or call a number you already trust.
3. Ask someone you trust. A family member, friend or support person can help you check. There's no shame in asking.
4. If you've already acted, get the right help. Clicking a link alone doesn't necessarily mean anything bad happened. But if you entered a password, gave someone access, shared banking details or sent money, take prompt steps using the guides below.

Not sure? Here's what to do

• A bank alert: “Unusual activity detected. Sign in now.” Check through your bank's official app or a phone number you know is genuine, not the email link.
• An unexpected invoice: “Payment overdue. Open the attachment.” Check whether you recognise the business and purchase before opening anything or paying.
• A message from someone you know: “I'm in trouble. Please send money.” Their account may have been taken over. Contact them another way, such as calling their usual number.

Other messages you might receive

A scam can look polished and friendly. It may even mention a delivery or purchase you're expecting.

Example 3: A convincing-looking fake email

Some emails are simply useful reminders. We can look for clues, but we can't prove an email is genuine just from how it looks.

Example 2: An email that may be genuine

This message tries to make you act quickly. Notice how it asks for private information.

Example 1: A suspicious email

What if you're still unsure?

Remember, in most situations, you have time. You don't have to rush. Scammers often create a false sense of urgency. You can stop, think and check before responding to a suspicious message.

Leave the message alone for now. Open the organisation's official app or website yourself, or ask someone you trust. If you only received the email and did not interact with it, you can usually delete or report it without further action.

If you entered a password, shared banking details, installed something or sent money, use the relevant online safety guide for the next steps.

← See all online safety topics