Misspelling slightly: paypai.com, paypall.com<\/li>\n<\/ul>\n\n\n\nLegitimate companies own and use their primary domain. Amazon uses @amazon.com. Your bank uses @bankname.com. Government agencies use .gov domains. If the domain doesn’t match exactly, the email isn’t legitimate.<\/p>\n\n\n\n
Some companies use subdomains for different departments. Chase might send from alerts@chase.com or customer.service@chase.com. Both end in @chase.com, so they’re legitimate. But chase@alerts.com or chase@customer-service.com are not, because the primary domain isn’t chase.com.<\/p>\n\n\n
Step 2: View and Analyze Email Headers<\/h2>\n\n\n
Email headers contain routing information that shows the email’s actual path from sender to your inbox. Scammers can’t fake this.<\/p>\n\n\n\n
To view headers in Gmail:<\/strong> Open the email, click the three dots in the top right corner, select “Show original.” This opens a new window with the full header information.<\/p>\n\n\n\nTo view headers in Outlook:<\/strong> Open the email, go to File, then Properties. The header information appears in the “Internet headers” box. In Outlook.com (web version), open the email, click the three dots, select “View message source.”<\/p>\n\n\n\nTo view headers in Yahoo Mail:<\/strong> Open the email, click “More” (three dots), select “View raw message.”<\/p>\n\n\n\nWhat to look for in headers:<\/strong><\/p>\n\n\n\nFind lines starting with “Received:”. These show each server that handled the email, listed in reverse chronological order. The bottom “Received:” line shows where the email actually originated.<\/p>\n\n\n\n
Compare the originating server to the claimed sender. If an email claims to be from Chase Bank but the headers show it originated from a server in a random domain, it’s fake.<\/p>\n\n\n\n
Look for authentication results. Headers show if the email passed SPF, DKIM, and DMARC checks. These are email authentication standards. Legitimate companies configure these correctly. You’ll see lines like:<\/p>\n\n\n\n
\n- Authentication-Results: spf=pass<\/li>\n\n\n\n
- DKIM-Signature: (shows verification)<\/li>\n\n\n\n
- DMARC: pass<\/li>\n<\/ul>\n\n\n\n
Failed authentication checks are red flags. If you see “spf=fail” or “dkim=fail,” the email didn’t come from where it claims.<\/p>\n\n\n\n
Headers look technical and contain a lot of information. You don’t need to understand everything. Focus on the originating server and authentication results. If those don’t match the claimed sender, the email is spoofed.<\/p>\n\n\n
Step 3: Verify Links Without Clicking<\/h2>\n\n\n
Never click links in suspicious emails. Instead, hover your mouse over them to see where they actually go.<\/p>\n\n\n\n
Your email client or browser displays the real URL when you hover. If the email claims to be from your bank but the link goes to a random website, it’s a scam.<\/p>\n\n\n\n
Legitimate company links match their official domains. Bank of America links go to bankofamerica.com. Apple links go to apple.com. IRS links go to irs.gov.<\/p>\n\n\n\n
Watch for these link tricks:<\/p>\n\n\n\n
Display text doesn’t match the URL:<\/strong> The link text says “www.chase.com” but hovering reveals it actually goes to scamsite.com. Scammers hide malicious URLs behind legitimate-looking text.<\/p>\n\n\n\nShortened URLs:<\/strong> Links using bit.ly, tinyurl, or other URL shorteners hide the real destination. Legitimate companies rarely use shortened links in official emails because they look suspicious.<\/p>\n\n\n\nIP addresses instead of domains:<\/strong> Links to IP addresses like http:\/\/192.168.1.1 instead of company names. Real companies use their branded domains, not raw IP addresses.<\/p>\n\n\n\nLong, complex URLs with weird parameters:<\/strong> Extremely long links with random characters might be trying to hide the real domain in the middle of the URL.<\/p>\n\n\n\nIf you need to access your account or verify information, don’t use links from the email. Type the company’s official website address directly into your browser or use your bookmarks.<\/p>\n\n\n\n