Spotting Scam Emails: A Practical Walk-Through for Everyday Inboxes

Almost every scam email depends on one thing: you reacting before you think. The message says your account will close, a parcel is stuck, or a payment failed, and it wants an answer within minutes. The first skill I teach in Internet Safety Essentials is simply pausing. Nothing in a legitimate email becomes worse because you took ten minutes to look at it properly.

Sit at a table with the message open, and treat it like a letter that arrived in the mail from someone you do not recognize. You would not hand over your bank details to a stranger at the door because they sounded urgent. The same patience applies on a screen. Close other windows, put the phone down, and read the whole message once without touching anything.

If you feel your stomach tighten while reading, that is useful information. Fear and hurry are the tools a scammer relies on. Naming the feeling out loud, even quietly to yourself, often loosens its grip enough for the next steps to work.

• Read the whole message once before clicking anything
• Notice any pressure to act within minutes or hours
• Step away for ten minutes if you feel rushed

Every email has a display name and a sender address, and they are not the same thing. The display name can say anything at all, such as your bank or a delivery service. The address behind it is what counts. On most computers you can hover the mouse over the name, and on a phone you can tap it, to reveal the full address underneath.

Look at the part after the @ sign. A genuine message from an organization you deal with comes from its own proper domain. Scam addresses often carry odd extras: extra words, swapped letters, a string of numbers, or a free webmail ending that no real company would use for official notices.

Also notice how the message greets you. Phrases such as dear customer or dear account holder, when the organization normally uses your name, are a reason for caution. None of these signs proves a scam alone, but two or three together should send you to the next step rather than the reply button.

• Reveal the real address behind the display name
• Check the ending after the @ sign for odd spellings
• Be wary of generic greetings from places that know your name

A link in an email can show one thing and lead somewhere else. On a computer, rest the mouse pointer over the link without clicking and read the address that appears at the bottom corner of the window. On a smartphone, pressing and holding the link usually shows a preview of its destination. If the address looks unrelated to the sender, long, or full of random characters, leave it alone.

Attachments deserve the same care. Unexpected files such as invoices, voice messages or documents you never asked for are a common way to install harmful software. If a message says a file is urgent but you were not expecting it, treat that mismatch as the warning.

A safer habit is to avoid the email's links altogether. If a message claims to be from your bank, open your browser yourself and type the bank's website the way you always do, or use the bookmark you saved earlier. Then check whether any notice is waiting in your account.

• Hover or press and hold to preview where a link leads
• Do not open attachments you were not expecting
• Go to the website yourself instead of using the email link

Banks, government offices and utility companies have rules about what they will ask for by email, and knowing those rules makes many scams easy to dismiss. A real bank will not ask you to confirm a full password, a PIN or a security code by replying to a message. Government offices do not demand payment in gift cards, and no genuine service asks you to install software so that someone can look at your screen after an unprompted message.

Be especially careful with requests that involve secrecy or unusual payment. Anyone asking you to keep a transaction quiet from family, or to pay in a way that cannot be reversed, is not behaving like a trustworthy organization. These patterns repeat again and again, even though the stories wrapped around them change with every season.

Autumn brings its own versions: messages about tax refunds, missed deliveries ahead of the holidays, and renewal notices for services you may not even use. When a message arrives that fits the season a little too neatly, take an extra moment before trusting it.

• No genuine bank asks for your PIN or full password by email
• Gift card payments are never a legitimate demand
• Secrecy and unusual payment methods are red flags

If you decide a message is suspicious, you do not need to reply, argue or warn the sender. Simply do not click anything. Most email programs have a button to mark a message as junk or report phishing, and using it helps filter similar messages out of your inbox in future. After that, deleting the email is perfectly fine.

If you are unsure rather than certain, contact the organization by a route you already trust: the phone number printed on your card or statement, or a website you typed in yourself. Ask them whether they sent anything. Staff at real organizations are used to this question and are glad you checked.

If you already clicked or typed something in, stay calm and act promptly. Change the password for that account, and for any other account where you used the same one. Contact your bank if payment details were involved, and keep the message in case you need to describe it. Being caught once is common and says nothing about your intelligence.

• Report as junk or phishing, then delete the message
• Verify through a phone number or website you already trust
• Change passwords quickly if you did click or type details

Skills stick when they become small habits. A routine of four questions works for most inboxes: Was I expecting this? Does the sender address match the organization? Is it rushing me? Would I be comfortable verifying it another way? If any answer troubles you, stop and check before acting.

Practise on messages that have already arrived. Open your junk folder with a cup of tea and read a few of the messages sitting there, hovering over senders and links as described above. Seeing real examples of poor spelling, strange addresses and manufactured urgency trains your eye far better than reading rules once.

It also helps to talk about what you see. Mention a strange message to a friend or relative, and invite them to do the same. Scams lose much of their power once they are discussed openly rather than faced alone in a quiet room.