Paste the email
Analysis runs entirely in your browser. The email is never uploaded or stored, and links in it are never opened.
Try a sample
Free email tool
Is This Email a Scam? Free Phishing Email Checker
To tell if an email is a scam, check the real sender address and domain, look for links whose real destination differs from the text, and watch for urgency and unusual payment requests like gift cards or crypto, plus failed SPF, DKIM or DMARC in the headers. Paste the email below to check all of these at once.
Result
Paste an email and select Check email, or try a sample. The verdict and every red flag will appear here.
This is a heuristic checker. It can miss scams and can flag legitimate mail, so it is not a guarantee either way.
What to do next
- Don't click links, open attachments, reply, or call any phone number in the email (and don't use its "unsubscribe" link).
- If it might be real, contact the company through its official website or app. Type the address yourself, or reach the person another way.
- Report it in Gmail: open the message, next to Reply click More, then click Report phishing.
- Report it in Outlook: select the message, on the Home tab select Report, then choose Report Phishing (Outlook for Mac: Message menu > Report).
- Report the scam to the FTC at reportfraud.ftc.gov.
- Delete the email.
Already clicked or paid?
- Entered a password? Change it from the official site or app (and anywhere you reused it), then turn on 2-step verification.
- Paid by card, gift card, wire or crypto? Contact your bank or card issuer, the gift card issuer, the wire transfer company, or the crypto exchange immediately, say it was a scam, and ask them to reverse it.
- Opened an attachment or installed something? Run a full scan with your security software.
- Watch your bank, card and account activity closely for the next few weeks.
- Gave your Social Security number or think your identity is being misused? Go to IdentityTheft.gov for a recovery plan.
Common scam email red flags
The sender name and address don't match
"PayPal Support" <paypal.help.desk@gmail.com>
A lookalike domain
paypa1.com, micros0ft-support.com, paypal.com.account-verify.ru
A link that goes somewhere else
Text says usps.com, but the link opens bit.ly/3x9…
Urgency or threats
"Your account will be suspended within 24 hours"
Unusual payment requests
Gift cards, bitcoin, wire transfers, or Zelle to a person
Call-this-number invoices
"Your Geek Squad renewal of $399.99… call +1 (808) 555-0147 to cancel"
Requests for passwords or personal details
"Verify your account" or "confirm your Social Security number"
Risky attachments
.html, .zip, .iso, .exe or macro-enabled .docm/.xlsm files
Spelling and grammar are not a reliable signal any more. CISA notes that with AI, some phishing emails now have perfect grammar and spelling, so this checker ignores writing quality and looks at the other signs.
How to view the full headers in Gmail and Outlook
Gmail (computer)
Open the email. Next to Reply, click More, then Show original. The full header opens in a new window; copy all of it and paste it here.
New Outlook, Outlook.com and Outlook on the web
Open the message, select More actions at the top of the message window, then View > View message details.
Classic Outlook for Windows
Double-click the message to open it in its own window, then click File > Properties. The headers are in the Internet headers box.
Sources: CISA: Recognize and Report Phishing, Gmail Help: Trace an email with its full headers, Gmail Help: Avoid & report phishing emails, Microsoft Support: View internet message headers in Outlook, Microsoft Support: Report suspicious messages in Outlook
How to check if an email is a scam
- 1
Copy the suspicious email
Copy the email text, or for a deeper check copy the full source: in Gmail use More > Show original; in Outlook use View message details or File > Properties. You can also upload an .eml file.
- 2
Paste it into the checker
Paste it into the box (and the sender name and address if you only have the visible text), then select Check email. Everything runs in your browser.
- 3
Review each red flag
Read the verdict and each red flag with its evidence, then follow the next steps: don't click or reply, verify through the official site or app, report it and delete it.
Frequently asked questions
How can I tell if an email is a scam?
Check the real sender address and its domain, not just the name shown. Hover over links to see where they really go, and be wary of urgent threats, requests for passwords or personal details, and unusual payment requests such as gift cards, crypto or wire transfers. In the full headers, failed SPF, DKIM or DMARC is a strong warning sign.
What happens if I open a phishing email?
Simply opening a phishing email in an up-to-date mail app is usually low risk. The danger comes from what you do next: clicking a link, opening an attachment, entering a password or payment details, replying, or calling a number in the message. If you did nothing else, report it and delete it.
How do I report a phishing email in Gmail or Outlook?
In Gmail on a computer, open the message, click More next to Reply, then click Report phishing. In Outlook, select the message, then on the Home tab select Report and choose Report Phishing (in Outlook for Mac, use the Message menu > Report). You can also report scams to the FTC at reportfraud.ftc.gov.
What should I do if I clicked a link in a phishing email?
If you entered a password, change it from the official site or app, including anywhere you reused it, and turn on 2-step verification. If you paid or shared card details, contact your bank, card issuer, gift card issuer or crypto exchange immediately. Run a security scan, watch your accounts, and use IdentityTheft.gov if your personal information was exposed.
Can a scam email pass SPF, DKIM and DMARC?
Yes. SPF, DKIM and DMARC only prove that the message really came from the domain it claims. A scammer who registers a lookalike domain such as paypal-secure-login.com can set all three up and pass. That is why this checker also looks at the domain itself, the links and the wording.
Related tools
Email Header Analyzer
Trace every server hop and read SPF, DKIM and DMARC results from full headers.
Email Authentication Scorecard
Grade a domain's SPF, DKIM, DMARC and BIMI setup.
EML Viewer
Open an .eml file in your browser to inspect headers, parts and attachments safely.
DMARC Checker
See whether a domain publishes a DMARC policy that blocks spoofing.
URL Safety Checker
Check a single suspicious link on Lie Library before you open it.