In 1971, Ray Tomlinson, a computer engineer at BBN Technologies,
modified message-sending programs for the ARPANET network to send
messages between different computers, introducing the @ symbol to
route messages to a specific host computer (user@host).
Today, while less common for casual online conversations, email
remains widely used for professional communication, business
correspondence, and formal inquiries. This gives email a high level of
perceived trustworthiness, making it an attractive medium for scammers
to deceive victims and exploit that trust.
While most popular email providers can now detect and filter scam and
phishing emails, they aren't always reliable. Just as legitimate
emails can be incorrectly flagged as spam, malicious emails can slip
through these filters and reach your inbox. Therefore, it is important
to know how to identify illegitimate emails without relying solely on
your email provider to get it right.
01
Check the sender
Always check who sent you an email before trusting its contents.
Scammers often impersonate legitimate companies, organizations, or
individuals by using display names and email addresses that look
convincing at first glance. Pay close attention to the actual email
address, particularly the domain name after the @ symbol. A familiar
display name does not necessarily mean the email came from a
legitimate sender.
Examples
support@google.com
Legitimate
support@googIe.com
Suspicious
The lowercase "l" in Google has been replaced with an uppercase
"I", which can look similar in certain fonts.
google-support@gmail.com
Suspicious
While gmail.com is a legitimate email provider, it would be
unusual for a company like Google to use a generic email
provider instead of its official domain.
support@google.security-check.com
Suspicious
Although it may appear legitimate, the actual registered domain
is
security-check.com, notgoogle.com.
02
Be cautious of unexpected attachments
Unexpected email attachments can contain malicious files designed to
infect your device, steal information, or install unwanted software.
Be especially cautious of unfamiliar file types, executable files,
and documents that ask you to enable macros. If you weren't
expecting an attachment, verify with the sender through another
communication method before opening it.
Examples
Invoice_93821.pdf.exe
Suspicious
An executable file disguised as a PDF invoice. The file
extension is always the part of the filename that appears to the
right of the final .. Any extensions appearing
before it are simply part of the filename.
Resume_Carter.docm
Suspicious
An unexpected Word document that may contain malicious macros.
Package_Tracking.zip
Suspicious
An unexpected compressed attachment claiming to contain delivery
information.
Payment_Receipt.html
Suspicious
An HTML attachment that could redirect you to a fraudulent login
page.
03
Watch out for urgency and threats
Scammers often create a false sense of urgency to pressure you into
acting without thinking. Messages may claim that your account will
be suspended, a payment is overdue, or you've won a prize that
requires immediate action. Be suspicious of emails that pressure you
into clicking links, providing information, or making payments.
Examples of Urgency and Threats
Account Suspension
"Your Microsoft account will be permanently suspended within
24 hours unless you verify your identity."
Unpaid Invoice
"Your payment of $499 is overdue. Pay immediately to avoid
additional charges."
Security Alert
"We detected suspicious activity on your bank account. Click
here immediately to prevent unauthorized access."
Prize Notification
"Congratulations! You've been selected to receive a $1,000
gift card. Claim your prize within the next 30 minutes."
Government Threat
"An outstanding tax balance has been detected. Failure to pay
immediately may result in legal action."
04
Check for suspicious links
Emails can contain hyperlinks that disguise their actual
destinations. Before clicking anything, hover over links on desktop
or press and hold them on mobile to preview the destination. Make
sure the URL matches the organization the email claims to represent.
05
Never share sensitive information
Legitimate organizations generally won't ask you to send passwords,
verification codes, or other sensitive information through email. Be
particularly cautious of messages requesting banking information,
account credentials, or personal identification.
Examples of Requests for Sensitive Information
Password Request
"Reply to this email with your account password to verify your
identity."
Verification Code Request
"Please forward the six-digit verification code we just sent
you to confirm your account."
Banking Information
"Your direct deposit information is outdated. Reply with your
account and transit numbers to avoid payment delays."
Identity Verification
"Please attach a photo of your driver's licence and other
identification documents to complete your verification."
06
Watch out for unexpected requests
Be cautious of emails requesting unusual actions, especially when
they involve money, gift cards, payments, or changes to account
information. Scammers may impersonate coworkers, managers, or family
members to make their requests appear legitimate. Verify unusual
requests through another communication method.
Examples of Requests for Sensitive Information
Gift Cards
"I need you to purchase five $100 gift cards and send me the
activation codes. I'll reimburse you later." (Impersonating a
manager.)
Urgent Payment
"Please transfer $4,500 to this new bank account before the
end of the day." (Impersonating a business executive.)
Payroll Changes
"We've updated our banking provider. Please change your direct
deposit information using the attached form."
Family Emergency
"Hey, it's me. I lost my phone and need you to send me some
money. I'll explain everything later."
07
Look for inconsistencies
Pay attention to unusual wording, spelling mistakes, inconsistent
branding, and formatting issues. While these aren't definitive signs
of a scam, they can indicate that an email isn't from the
organization it claims to represent.
Examples of Inconsistencies
Spelling Mistakes
An email from a supposed professional organization contains
numerous spelling and grammatical errors.
Inconsistent Branding
An email claiming to be from Microsoft uses outdated logos,
incorrect colours, or unfamiliar formatting.
Unusual Wording
A supposedly Canadian bank sends an email containing awkward
phrasing or terminology that doesn't match its usual
communications.
Poor Formatting
Text is misaligned, images appear broken, or different fonts
and formatting styles are used throughout the message.
08
Be careful with reply-to addresses
Always check who sent you an email before trusting its contents.
Scammers often impersonate legitimate companies, organizations, or
individuals by using display names and email addresses that look
convincing at first glance. Pay close attention to the actual email
address, particularly the domain name after the @ symbol. A familiar
display name does not necessarily mean the email came from a
legitimate sender.
Examples
Sender
Legitimate
support@google.com Reply-To support@google.com
Sender support@google.com Reply-To
support@google-support.com
Suspicious
Different domains.
Sender support@google.com Reply-To
support.google@gmail.com
Suspicious
Uses a personal email provider.
Sender support@google.com Reply-To
johndoe123@outlook.com
Suspicious
Unrelated email address.
Additional Recommendations
If you're still unsure whether an email is legitimate, there are a
couple ways to verify it. First, vistit the compan'ys official
website and look for its listed contact information. Alternatively,
find a previous email from the same company and compare the sender's
email address with the one you're suspicious of. Second, if the
company provides a support address, contact them directly and ask
whether the message is legitimate. You can include a screenshot of
the suspicious email, making sure to censor any sensitive or
personal information. Their support team should be able to help you
determine whether the email is genuine.