We all get them. An urgent message from "Netflix" saying your account has been suspended. An alert from "Amazon" about a package you never ordered. A warning from your bank that something is wrong and you need to act now.
They look real. The logos match. The wording sounds official. And they're designed to make you feel like you have about 30 seconds to do something before disaster strikes.
That pressure is the whole point. When you're stressed, you stop thinking carefully. And that's exactly when people click links they shouldn't.
Here's the good news: there's one thing scammers can never fake, and it takes about three seconds to check.
The One Thing They Can't Fake
Scammers can copy a company's logo. They can match the colors and fonts. They can write text that sounds exactly like a real customer service message. But there's one thing they cannot do: send from the company's actual email address.
That's your check.
When an email arrives claiming to be from a company, ignore the display name at the top. That part can say anything at all. "Netflix Support," "Amazon Customer Service," "Your Bank Security Team" -- any of these can be typed by anyone.
Instead, look at the actual email address. Specifically, look at everything that comes after the @ symbol.
A real email from Netflix will always end in @netflix.com. A real email from Amazon will end in @amazon.com. A real email from your bank will end in their actual domain.
A scammer's address might look something like netflix-support@security-alert-xyz123.com. The display name says Netflix, but that domain after the @ has nothing to do with Netflix. That's all you need to see.
If what comes after the @ doesn't perfectly match the company's real website address, it's a fake. Delete it without clicking anything inside it.
What to Do When You're Not Sure
Sometimes the address looks close but something seems slightly off. Scammers do this on purpose. They might use @netfl1x.com with a number instead of a letter, or @amazon-support.com with a hyphen and extra word added.
If anything about the address looks even a little strange, don't click any links inside the email. Instead, go directly to the company's website by typing the address yourself in your browser, or call the number on the back of your card or on a bill you already know is real.
The email might feel urgent. That's fine. You can still deal with whatever the issue is, just through a route you know is legitimate.
A Few More Things Worth Knowing
Real companies will never ask for your password by email. Ever.
Real companies will never ask you to buy gift cards to resolve an account issue.
Real alerts from your actual bank will include your name, not just "Dear Customer" or "Account Holder."
And real emails from companies you do business with will come from the same domain you'd type to visit their website. That's the check that catches almost everything.
This week we've been walking through the tricks scammers use and how to see through them. Tomorrow we'll look at what to do when a scam page locks up your entire screen.
The 3-Second Check: How to Spot a Fake Email Before You Click
Scammers can copy any logo and write like any company, but there's one thing they can never fake. Here's the three-second check that catches almost every phishing email.