The 30–second sketchy email test
When a suspicious email or text comes in, run this quick test. If anything feels off, treat the message as untrusted and go directly to the company’s website or app instead.
- ⚠️ Sender looks odd: the from-address is slightly wrong, or from a free email service when it shouldn’t be.
- ⚠️ Urgency or threat: “do this in 24 hours or your account will be closed” style pressure.
- ⚠️ Strange links or attachments: unexpected files, or links that look nothing like the real company website.
- 🤔 Generic greeting: “Dear customer” instead of your real name, when the company should know who you are.
- ✅ Verified elsewhere: you ignore the email, log into the real website or app yourself, and see the same alert there.
1. Look closely at who it’s really from
Email apps often show a friendly name, but the real clue is the actual email address.
Red flags in the sender
-
Misspellings or extra words, like
support@paypa1-security.cominstead of@paypal.com. - A free email service (Gmail, Outlook, Yahoo) claiming to be a big company you’d expect to have its own domain.
- A reply-to address that’s different from the from-address, especially if the reply goes to a random person.
If something feels off here, don’t click anything. Instead, open your browser,
type the company’s address yourself (like www.paypal.com), and check
your account from there.
2. Watch out for pressure and fear tactics
Many sketchy emails try to rush you so you don’t think clearly. Common themes:
- “Your account will be closed in 24 hours.”
- “We noticed suspicious activity. Verify your information now.”
- “You’re owed a refund. Claim it immediately.”
Real companies may send serious alerts, but they usually don’t demand instant action through a single link in an email. They also tend to give you multiple ways to verify the issue (website, app, phone support).
3. Hover over links before you click
On a computer, hover your mouse over a link and look at the address that appears (usually at the bottom of your email app or browser). On a phone, you can often tap and hold to preview the link.
Good vs. bad examples
-
More trustworthy:
https://www.bankname.com/security/alerts -
Suspicious:
http://bankname.secure-check-verify.info/login - Very suspicious: any link that’s just a random string of numbers or letters, or a shortening service you don’t recognize.
If you can’t clearly tell where a link goes, don’t use it. Go to the company’s site by typing the address yourself.
4. Be extra careful with attachments
Attachments are a common way to deliver malware. Treat them with suspicion if:
- You weren’t expecting any attachment from that person or company.
-
The file type is something that can run code, like
.exe,.scr, or even some.zipfiles. - The email says you must open a file to “see your invoice,” “verify your account,” or similar.
When in doubt, don’t open it. Again, visit the official website directly and see if there is really an invoice, alert, or document waiting for you.
5. Check the tone, spelling, and details
No company is perfect, but sloppy phishing messages are still common. Signs of a sketchy email include:
- Lots of spelling or grammar mistakes.
- Odd phrasing that doesn’t sound like a native writer for that company.
- Logos that look low-quality or slightly wrong colors.
- Generic greetings like “Dear user” when a company usually uses your name in real messages.
6. Use the “separate channel” rule
One of the safest habits you can build is this:
If a message asks you to do something important (pay, reset, confirm), verify it through a separate trusted channel.
For example:
- If your “bank” emails you, log in through the bank app or official website instead.
- If “IT support” messages you at work, call them or message them through your usual system.
- If a friend asks for money by email, confirm with a quick call or text.
7. Simple shareable checklist (for family & coworkers)
You can treat this as a mini policy at home or in a small business: before anyone clicks on a scary email, they run through these questions:
- 1️⃣ Do I actually use this company or know this person?
- 2️⃣ Is the sender’s email address spelled correctly and on the right domain?
- 3️⃣ Is the message trying to rush or scare me into acting?
- 4️⃣ Do the links clearly go to the real website when I hover or preview them?
- 5️⃣ Was I expecting this attachment or request?
- 6️⃣ Could I verify this using the official website, app, or a phone call instead?
If any of these answers feel wrong or uncertain, treat the message as untrusted. Verify the situation another way before responding or clicking.
8. What to do if you already clicked
Mistakes happen. If you think you may have clicked a bad link or entered information into a fake page:
- Change the password for the affected account immediately.
- If you reused that password, change it anywhere else you used it (start with email and banking).
- Turn on multi-factor authentication (MFA/2FA) for important accounts if you haven’t already.
- If you entered card or bank details, contact your bank or card issuer and explain what happened.
Key takeaways
- You don’t have to become a security expert to avoid most sketchy emails.
- Slow down for 30 seconds and check sender, links, tone, and urgency.
- When in doubt, visit the official website or app instead of using email links.
- Share a simple checklist with family or coworkers to help everyone stay safer.