Home > Security Guides > How to Check a Suspicious Email Safely Before You Click

How to Check a Suspicious Email Safely Before You Click

Not sure an email is real? Follow these steps to check the sender, headers and links without clicking, verify the claim yourself, and report phishing.

m00s3c
November 4, 2026
November 4, 2026

Between October 28 and 30, up to 7.13 million phishing emails impersonating credit card companies went out from the real address of a legitimate Japanese email delivery service. They passed the usual technical checks because they came from a genuine sender. That is the uncomfortable lesson of the Arara Message breach: a message can look authentic, come from a real company domain, and still be a trap.

This guide walks you through checking a suspicious email without clicking anything risky. It takes about 10 minutes the first time and works for Gmail, Outlook and Yahoo Mail. The goal is simple: decide whether the message is real using information you control, not information the email hands you.

Before you start

Use a computer if you can. Hovering over links and reading message headers is much easier on a desktop browser than on a phone.
Do not reply, click links, open attachments, scan QR codes, or call phone numbers in the message until you finish these steps.
Keep the message. Do not delete it yet, because you will need it to report it.

Step 1: Stop and look for pressure

Phishing works by rushing you. Read the message once, slowly, and look for the red flags the FTC lists in its phishing guidance: claims of suspicious activity or login attempts, a problem with your account or payment information, a request to confirm personal or financial details, an invoice you don’t recognize, or an offer that seems too good to be true. The Arara emails used exactly this playbook, with subject lines asking recipients to confirm card usage or review a billing statement.

Ask yourself one question: does this email want me to act right now? If the answer is yes, treat it as suspicious until proven otherwise.

What success looks like: You have named the specific action the email wants (log in, pay, call, download) and you have not done it.

Step 2: Check the real sender address

The display name (“Card Services”, “Amazon Support”) is just text anyone can type. Click or tap the sender name to reveal the full address, then read the domain after the @ sign carefully. Watch for lookalikes such as extra words, swapped letters, or a free email provider pretending to be a bank.

Your mail app also gives you hints:

Gmail: A question mark next to the sender’s name means Gmail could not authenticate the message. Open the sender details and look for “Mailed by” and “Signed by” lines showing the sending domain. A “via” label means the message was sent through a different domain than the one shown.
Outlook: A question mark in the sender image means the sender could not be verified, and a “via” tag means the visible address differs from the domain that actually sent it.

Remember the Arara lesson here. A correct, authenticated domain proves the email came from that company’s systems. It does not prove the company meant to send it.

What success looks like: You know the exact sender domain and whether your mail app flagged it as unverified.

Step 3: Read the full message headers

Headers record the path a message took and whether it passed authentication checks. Here is how to open them:

Gmail on the web: Open the message, then next to Reply click More (three dots) and choose Show original.
New Outlook, Outlook on the web and Outlook.com: Open the message, select More actions (three dots), then View and View message details.
Classic Outlook for Windows: Open the message in its own window, then choose File and Properties. The headers appear in the Internet headers box.
Yahoo Mail: Open the message, click More (three dots) and choose View Raw Message.

Copy all of the header text. Then paste it into Google’s free Messageheader tool and click Analyze the header above. It turns the raw text into a readable summary that shows the sending servers and the results for SPF, DKIM and DMARC.

A fail on any of these for a message claiming to be from your bank is a strong sign of spoofing. A pass only tells you the email really came from that domain’s mail systems, which is why the next steps still matter.

What success looks like: You can see whether SPF, DKIM and DMARC passed or failed, and whether the sending domain matches the company the email claims to be.

Step 4: Inspect links without clicking them

On a computer, hover your mouse over each link or button and read the address that appears in the corner of your browser or mail window. On a phone, press and hold the link until a preview appears, then back out without opening it. The domain should belong to the company, not a URL shortener, a random string, or a lookalike.

If you want a second opinion on a link, right-click it, choose Copy link, and paste it into Google Safe Browsing site status. A clean result does not mean a link is safe, because brand new phishing pages often have not been flagged yet. A flagged result is a clear stop sign.

Security pros also use VirusTotal for this. Be aware that VirusTotal says anything you submit is added to its dataset and shared with the security community, so never paste links that contain your name, email address, account numbers or login tokens.

What success looks like: You know where every link actually goes, and you have not visited any of them.

Step 5: Leave attachments and QR codes alone

Unexpected attachments are one of the most common ways infostealer malware gets onto a computer. Be especially wary of ZIP files, HTML files, disk images, and documents that ask you to “enable content” or “enable editing”. QR codes in emails are just links in disguise, and scanning one with your phone skips the hover check from Step 4.

If you think an attachment might be legitimate, get the same document another way, such as by signing in to the company’s website directly.

What success looks like: No attachment has been opened and no QR code has been scanned.

Step 6: Verify through a channel you already trust

This is the step that beats even a perfectly authenticated phishing email. Contact the company yourself using a website you type into your browser, the app you already use, or the phone number printed on the back of your card or on a statement. Never use a link, phone number or reply address from the suspicious message.

Sign in the way you normally would and check for the alert, bill or problem the email described. If it is not there, the email was not telling the truth. If the message came from a coworker or vendor asking for money or a change in payment details, call them at a number you already have on file.

What success looks like: You have confirmed or ruled out the email’s claim without relying on anything inside it.

Step 7: Report it, then delete it

Reporting helps filters catch the same campaign for everyone else:

Gmail: Next to Reply, click More and choose Report phishing.
Outlook: Select Report and then Report phishing. This deletes the message but does not block the sender. Use Report junk if you also want to block them.
Anti-Phishing Working Group: Forward the email to reportphishing@apwg.org. If your mail app offers “Forward as attachment”, use it so the headers come along.
Federal Trade Commission: File a report at ReportFraud.ftc.gov.
Phishing text messages: Forward them to 7726 (SPAM).

If the email impersonated your bank or employer, forward it to their official fraud or security address too, which you can find on their real website.

What success looks like: The message is reported and gone from your inbox.

Step 8: If you already clicked or replied

Do not panic, but move quickly:

Entered a password: Change it right away on the real site, plus anywhere else you reused it. Turn on two-step verification and sign out other sessions. Gmail users can review recent security alerts at myaccount.google.com/notifications.
Opened an attachment or downloaded a file: Update your security software and run a full scan, as the FTC recommends. Our guide to infostealer malware explains what to look for next.
Shared card or bank details: Call the number on the back of your card and ask for a new card number. Our guide on what to do if your card was exposed covers the rest.
Shared your Social Security number: Go to IdentityTheft.gov for a recovery plan, and consider a credit freeze.

What success looks like: Every credential or payment detail you exposed has been changed, frozen or replaced.

Common mistakes

Trusting a pass: Passing SPF, DKIM and DMARC means the message came from that domain, not that it is safe. Compromised senders, like the one in the Arara incident, pass every check.
Calling the number in the email: Scammers staff phone lines too. Callback scams and vishing, like the attack behind the Harvard alumni data breach, rely on you dialing their number.
Unsubscribing: Clicking “unsubscribe” in a phishing email is still clicking a link, and it confirms your address is active.
Replying to ask if it is real: The person who answers is the scammer.
Checking only on your phone: Small screens hide full sender addresses and link destinations.
Reusing passwords: One phished password unlocks every account that shares it. Use our password generator to make unique ones.