How to Check If an Email Is Safe Before Opening It

~/sheets/how-to-check-if-email-is-safe.md
How to Check If an Email Is Safe Before Opening It
Email remains the number one attack vector for cybercriminals. Over 90% of cyberattacks start with a phishing email — a message designed to trick you into clicking a malicious link, downloading malware, or handing over your credentials. The attacks have gotten sophisticated enough that even security-aware people get fooled. Here is how to evaluate any suspicious email before it causes damage.
Check the Sender Address Carefully
The "From" name can say anything — it is the actual email address that matters. Look for these red flags:
Domain misspellings — "paypa1.com" instead of "paypal.com", "amaz0n.com" instead of "amazon.com"
Free email domains — legitimate companies do not send official emails from gmail.com or yahoo.com
Extra subdomains — "paypal.account-verify.com" is NOT paypal.com. The real domain is always the last part before the extension
Random strings — "noreply@xj72kf.com" is almost certainly malicious
Inspect Links Without Clicking
Hover over any link in the email (do not click) and look at the URL that appears:
Does the domain match the supposed sender?
Does it use HTTPS? (though even phishing sites use HTTPS now — read our HTTPS guide to understand why this alone is not enough)
Is it a shortened URL (bit.ly, tinyurl)? Legitimate companies rarely use URL shorteners in official emails
Does it contain your email address or other personal data encoded in the URL parameters?
Look for Urgency and Pressure Tactics
Phishing emails almost always create artificial urgency:
"Your account will be suspended in 24 hours"
"Unauthorized login detected — act immediately"
"You have won — claim within 1 hour"
"Your payment failed — update now or lose access"
Legitimate companies give you time. If an email pressures you to act immediately, that itself is a warning sign.
Check for Generic Greetings and Poor Writing
While AI has improved phishing email quality, many still contain telltale signs:
Generic greetings like "Dear Customer" or "Dear User" instead of your actual name
Grammar mistakes and awkward phrasing
Inconsistent formatting or mismatched logos
Requests for information the company should already have
Never Open Unexpected Attachments
Attachments are a primary malware delivery method. Be especially cautious with:
.exe, .scr, .bat — executable files that run code on your computer
.zip, .rar — compressed archives that may contain executables
.doc, .xls with macros — Office files that prompt you to "enable content" are almost always malicious
.pdf — can contain embedded scripts, though this is less common
If you were not expecting an attachment, contact the sender through a different channel to verify they sent it.
Verify Through Official Channels
If an email claims to be from your bank, a delivery service, or any company:
Do not click any link in the email
Open your browser and go directly to the company's website by typing the address
Log into your account normally and check for any notifications
Call the company using the number on their official website (not the number in the email)
Check If Your Email Has Been Compromised
If you are receiving more phishing emails than usual, your email address may have been exposed in a data breach. Attackers buy breach databases and use them for targeted phishing. Check your exposure with our Email Breach Checker — if your email appears in breaches, change your password and enable two-factor authentication immediately.
Protect Yourself Going Forward
Enable 2FA on your email — even if someone gets your password, they cannot access your inbox
Use a strong, unique email password — test it with our Password Strength Checker
Disable automatic image loading — this prevents tracking pixels from reporting that you opened the email
Use email aliases for signups — keep your primary email address private
Keep your software updated — patches fix vulnerabilities that malicious attachments might exploit
What You Should Do Now
Check if your email address is already circulating in breach databases — that is the main reason you receive phishing emails. Run it through our Email Breach Checker right now. Then run a full Privacy Checkup to evaluate your overall security posture and get a personalized action plan to reduce your risk.
Frequently Asked Questions
How do I check if an email is safe before opening it?
Inspect the actual sender address (not the display name) for misspelled domains, free email domains, or extra subdomains; hover over links without clicking to see the real URL; watch for urgency and pressure tactics; and never open unexpected attachments. When in doubt, verify through the company website typed directly.
How can I tell if an email is a phishing attempt?
Red flags include domain misspellings like "paypa1.com", artificial urgency ("your account will be suspended in 24 hours"), generic greetings like "Dear Customer", grammar mistakes, and requests for information the company should already have. Over 90% of cyberattacks start with a phishing email.
Which email attachments are dangerous?
Be especially cautious with executables (.exe, .scr, .bat), compressed archives (.zip, .rar) that may hide them, and Office files (.doc, .xls) that prompt you to "enable content", which are almost always malicious. If you were not expecting an attachment, verify with the sender through another channel first.
How do I verify an email really came from my bank or a company?
Do not click any link in the email. Open your browser, type the company address directly, and log in normally to check for notifications, or call the company using the number from their official website rather than the one in the email.
Why am I suddenly getting more phishing emails?
Your email address may have been exposed in a data breach; attackers buy breach databases and use them for targeted phishing. Check your exposure with our Email Breach Checker, and if your address appears, change your password and enable two-factor authentication.
Last updated: April 2026