The 60-Second Email Check

You don't need special software or technical knowledge to verify an email. This simple routine takes about a minute and will catch the vast majority of phishing attempts. Follow these steps every time you receive an email that asks you to do something — click a link, open an attachment, or provide information.

Step 1: Check the Sender

Look at the full email address, not just the name displayed. On most email apps, you can tap or hover on the sender name to see the complete address.

Many companies list their official email addresses on their website. For example, PayPal says they only send emails from @paypal.com or @e.paypal.com.

  1. Does the domain (after the @) match the real company? Example: @amazon.com is real, @amazon-delivery-support.com is not.
  2. Is the domain spelled correctly? Look for swapped letters, extra characters, or numbers replacing letters.
  3. Does the company actually use this email domain? When in doubt, check the company's official website.

Step 2: Read Without Clicking

Read the entire email without clicking anything. Ask yourself:

  1. Was I expecting this email? Did I actually make a purchase, request a password reset, or do whatever the email is about?
  2. Is it creating urgency? "Act now," "within 24 hours," "immediately" — these are pressure tactics.
  3. Does it ask for personal information? Passwords, PINs, card numbers, or Social Security numbers?
  4. Does the greeting use my real name, or is it generic like "Dear Customer"?

Step 3: Inspect the Links

Before clicking any link or button in the email:

If the link goes to a domain you don't recognise, or if it uses an IP address (a string of numbers like 192.168.1.1) instead of a company name, do not click it.

  1. On a computer: hover your mouse over the link (don't click). The real URL will appear at the bottom of your browser or in a tooltip.
  2. On a phone: press and hold the link (don't tap). A preview will show you where it goes.
  3. Check if the URL matches the real company's website. Look at the domain part specifically.
  4. Watch for slight misspellings or extra words in the URL.

Step 4: Verify Through Official Channels

If after checking you're still unsure whether the email is real, verify it by contacting the company directly — but not through any link or phone number in the email.

  1. Open your browser and type the company's website address manually (e.g., www.amazon.com).
  2. Log into your account and check for any alerts or messages there.
  3. If there's an issue with your account, the company's website will show it.
  4. Alternatively, call the company using the phone number on their official website (not the number in the email).

Step 5: When in Doubt, Delete

If an email feels wrong but you can't pinpoint why, trust your gut. Delete it. If it was real and important, the company will contact you again — and you can always check your account directly.

It's always better to delete a real email by mistake than to click a phishing link. A real company won't punish you for being cautious.