Detecting suspicious email means evaluating the request, identity and context without treating one visual clue as conclusive. Unwanted marketing, impersonation and malicious messages can look different, and a polished email can still be deceptive.
These six checks help decide whether to verify independently, report or seek assistance. For domain owners, unexpected payment and account-access requests deserve clear evidence before action.
1. Read the complete sender address
Check the address beyond its display name and compare the relevant domain carefully. An unfamiliar sender is a reason to investigate, not automatic proof of maliciousness.
Our typo-domain guide explains character and spelling confusion. Remember that a genuine account can also be compromised.
2. Identify what action is being requested
Does the message ask for credentials, payment, a file download or private information? Compare that with what you expected. Urgency can be a pressure tactic, but the actual request and verification route matter.
The NCSC’s phishing guidance explains deceptive communications and official response routes. Verify sensitive requests through known contact details obtained independently.
3. Assess the message beyond spelling
Review identity, context and the claimed relationship. Good grammar and copied branding do not certify legitimacy; poor formatting can also occur in an ordinary message.
For a hypothetical renewal notice, check the genuine registrar account and recorded deadline rather than assuming the email’s countdown is authoritative. This is an example, not a report of a received scam.
4. Treat links and attachments as separate questions
A displayed link label may hide a different destination. A familiar file extension is not evidence that an unexpected attachment is safe. Avoid interacting merely to see whether something harmful happens.
If a request concerns an existing account, use its known login route. Check the event there without following an unverified sign-in button.
5. Preserve headers for supported analysis
Google’s full-header documentation explains Gmail’s original-message view. Routing and authentication context can help a responsible provider investigate.
A passed identity check does not establish that every instruction is safe. Keep the original message and dates where the reporting process requires them, rather than relying only on a screenshot.
6. Use reporting and recovery controls appropriately
Use the mail provider’s spam or phishing controls and relevant official channels. Do not upload confidential message contents to a public service without understanding access and sharing terms.
If information or access was already affected, use the genuine provider’s recovery procedure and incident-specific NCSC guidance. Our brand-control guide helps maintain account responsibilities.
For a shared account, identify who is authorised to verify the request. That avoids conflicting replies or changes made before the account owner reviews the evidence.
Keep useful evidence and verify sensitive requests independently. Detection improves the decision process; no single check guarantees that an email is harmless.