Checking a suspicious email safely is a skill that saves time, prevents data loss, and protects your business. The instinct to quickly click a link to verify whether something is legitimate is exactly what attackers count on. This guide gives you a structured process for evaluating a suspicious message without taking any action that helps the attacker or puts your accounts at risk.
Start with sender, subject, and pressure
The first things to assess are the sender address, the subject line, and whether the message creates urgency or pressure to act quickly. Legitimate organisations — your bank, the ATO, a government agency, or a regular supplier — rarely send emails demanding you take action immediately or threatening consequences within hours. This pressure is a deliberate psychological technique designed to stop you thinking carefully.
Check the sender's full email address, not just the display name. Display names are trivially easy to fake — an email can show "Westpac Bank" as the name while the actual sending address is something like [email protected]. Right-click or hover over the sender name to reveal the full address. If the domain after the @ does not match the organisation's real domain, treat the email as suspicious.
Look at whether the subject line creates fear, urgency, or curiosity in a way that feels unusual for routine business correspondence. "Your account will be suspended in 24 hours," "Immediate action required," and "You have been selected" are all patterns commonly used in phishing emails to bypass critical thinking.
Inspect links without opening them
On a desktop, hover your mouse over any link in the email and check the URL that appears in your browser's status bar or in a tooltip. The displayed link text and the actual destination URL are often different in phishing emails. A link that reads "Verify your account here" might go to http://account-secure-login.malicious-domain.com/verify.
Look for lookalike domains — small changes to a legitimate URL that are easy to miss at a glance. Common techniques include replacing letters with similar-looking characters (rn looks like m), adding subdomains that include the real brand name (westpac.fake-site.com), or using country-code domains to add credibility (ato.gov.malicious.site).
Do not copy the URL and paste it into a browser to "just check." If the destination is a phishing page, visiting it — even without entering anything — can sometimes track that you clicked the link, confirm that your email address is active, or in rare cases exploit browser vulnerabilities. If you need to investigate the URL, use an online URL scanner like VirusTotal or URLVoid.
What not to paste into any checker
If the email contains a code, a reference number, a password, or any text that looks like a credential or session token, do not paste it into a third-party tool or share it with anyone who did not originate it. The same applies to attachments — do not open attachments from unexpected senders, even if the file appears to be a PDF or a Word document. Malicious macros and embedded scripts are common in Office documents.
- Check the full sender email address — not just the display name.
- Hover over links to see the real destination URL before clicking anything.
- Look for lookalike domains: subtle misspellings, added subdomains, unusual TLDs.
- Do not open attachments from unexpected senders — even PDFs can carry malicious content.
- If the message creates urgency or threatens consequences, slow down rather than speed up.
- Use VirusTotal or URLVoid to check URLs — do not paste them into a browser directly.
- If you think an email is a scam impersonating a real organisation, forward it to that organisation's official scam reporting address.
A safe review process helps you inspect a message without helping the attacker.
Check a suspicious email