Email Scam Checker

How this email scam checker works

Paste the text of an email you are unsure about, and ThatScam looks for the patterns that scam and phishing emails tend to share: pressure to act fast, links that do not match the sender, requests for passwords or payments, and wording copied from known scams. You get a risk score from 0 to 100 and a plain-language list of the signals we found.

A few things worth knowing. The score shows risk signals, not a verdict, so a low score is not a guarantee and a high score is a reason to verify, not proof. Your text is analyzed in real time and is not stored. And the tool reads text only: it never opens your links or attachments, so you stay safe while you check.

How to tell if an email is a scam: 7 signals to check

Short on time? These are the checks that catch most phishing emails.

1. The sender address does not match the company. Ignore the display name and read the actual address. Support <help@paypa1-security.example> is not PayPal. Watch for swapped letters (rn for m, 1 for l), extra words (-support, -secure) and unusual endings.
2. The greeting is generic. "Dear customer" or "Dear user" from a service that normally uses your name is worth a second look.
3. It creates urgency or fear. "Your account will be closed in 24 hours" is designed to make you click before you think.
4. The link goes somewhere else. On a computer, hover over a link to preview the address. On a phone, press and hold. If the domain is not the company's real one, do not open it.
5. It asks for something a company would not ask by email. Passwords, one-time codes, full card numbers, or gift cards. Banks and big platforms do not request these in a message.
6. There is an attachment you did not expect. Invoices, "secure documents" and voicemail files in .zip, .html, .pdf or Office formats are common carriers for malware or fake login pages.
7. It is unexpected and too good (or too bad) to be true. Surprise refunds, prizes, job offers, or a bill for something you never bought.

One signal is not proof. Several together are a strong reason to stop and verify through another route, such as typing the company's address yourself or using its official app.

Common email scams right now

Fake delivery notices. A message says a parcel is held and asks for a small "redelivery" or customs fee. The payment page captures your card details.

Bank and payment alerts. "Unusual sign-in" or "payment declined" emails that lead to a copy of a login page.

"Account suspended" and security alerts. Imitations of Google, Apple, Microsoft or social networks, often with a countdown. Real security alerts exist too, which is why you should check by opening the official app or site yourself instead of the link.

Subscription and renewal receipts. An invoice for an antivirus, streaming or cloud service you never bought, with a phone number to "cancel". Calling it connects you to the scammer.

Fake invoices and payment requests. Aimed at small businesses: a supplier "changed bank details" or an invoice arrives from an address that looks like a colleague's or vendor's.

Prize, inheritance and advance-fee emails. A stranger offers money, and a "small fee" comes first.

Job offers. An unsolicited offer with high pay, little work, and a request for personal documents or an equipment purchase. If this is your case, try our Job Scam Detector.

Anonymized examples: what the signals look like

Example 1: account alert

From: "Account Security" <notice@secure-login-verify.example>
Subject: Action required: unusual sign-in
Dear user, we detected a sign-in from a new device. Verify within 24 hours or your account will be limited. [Verify now]

Signals: sender domain unrelated to any known service, generic greeting, 24-hour deadline, a single button with no explanation.

Example 2: invoice you did not expect

From: "Billing" <billing@service-renewals.example>
Subject: Your renewal of $289.99 was processed
Your subscription renewed today. If you did not authorize this charge, call 1-800-000-0000 immediately.

Signals: a charge for something you may never have bought, an alarming amount, a phone number instead of your account page. The aim is to get you on a call.

Example 3: parcel fee

Subject: Your parcel is on hold
We could not deliver your package. Pay a $2.49 redelivery fee within 48 hours or it will be returned.

Signals: no tracking number or order details, a tiny fee that hides a card-theft form, a deadline.

All sender names, domains and numbers above are invented.

How to check where an email really came from

The name you see in the "From" field can be anything. The headers show what the receiving server recorded.

• Gmail: open the email, click the three dots, then Show original. Look for SPF, DKIM and DMARC. "PASS" on all three is a good sign, but not a guarantee, since scammers also register their own domains and pass these checks for them.
• Outlook: open the message, then File, Properties, and read the Internet headers box.
• Apple Mail: View, Message, All Headers.

What matters most is that the domain in signed-by and mailed-by matches the company the email claims to be from. To include them in the analysis, paste the email body in the main box above, then click Add email headers (optional — improves accuracy) under it and paste only the key lines there: From, Return-Path, Authentication-Results (or the signed-by and mailed-by lines Gmail shows). Each box takes up to 1,000 characters, so the full headers are too long to paste.

I think I clicked a phishing link. What now?

Do not panic. Clicking alone often does nothing, and the risk goes up if you entered details or opened a file.

1. If you only clicked: close the page, clear your browser's recent history and cache if you want to be careful, and keep an eye on the account the email imitated.
2. If you typed a password: change it right away on the real site, and on every other account that uses the same password. Turn on two-factor authentication.
3. If you entered card or bank details: call your bank using the number on your card and ask to block the card and review recent transactions.
4. If you opened an attachment or installed something: disconnect from the internet, run a scan with your security software, and consider asking IT or a professional for help.
5. If you gave a one-time code or remote access to someone: treat the account as compromised, and sign out of all sessions from the account's security page.

How to report a scam email

• Gmail: three dots, then Report phishing.
• Outlook: Report, then Report phishing.
• Apple Mail / iCloud: forward to reportphishing@apple.com, as described on Apple's support page.
• The impersonated company: most have a reporting page or abuse address. Look for "report phishing" or "report a scam" on the company's official website, typed in yourself.
• United States: forward to reportphishing@apwg.org (see APWG) and report at reportfraud.ftc.gov.
• United Kingdom: forward to report@phishing.gov.uk (the NCSC Suspicious Email Reporting Service).
• Elsewhere: report to your national consumer protection or cyber-crime agency.

Other places to check

• Text message? Use the SMS Scam Checker.
• A link in the email? Use the Suspicious Link Checker (without opening it).
• A job offer? Use the Job Scam Detector.
• Not sure what kind of message it is? Try Is this message safe?