How to Check If an Email Is Phishing: The 60-Second VERIFY Test

Everyday AI Guides · AI Safety, Privacy & Trust

How to check if an email is phishing: do not judge it by perfect grammar, professional design, a familiar display name, or a convincing logo. Inspect the full sender address, identify what the message wants you to do, review links and attachments without opening them, and verify the request through a separate channel you already trust.

AI can help scammers write clearer, more personal, and more convincing messages. That makes older advice such as “look for spelling mistakes” less dependable. The safest decision is not based on how real the email looks. It is based on whether the sender and request can be verified independently.

This is the safest way to understand how to check if an email is phishing without allowing the suspicious message to control the verification process.

How to Check If an Email Is Phishing With the VERIFY Test

The VERIFY test is an ordered decision process, not a points system. You are not trying to prove that an email is safe by collecting reassuring clues. You are checking whether its visible identity, requested action, destination, and context can be confirmed outside the message.

Copy-Ready Phishing Email Checklist

Keep this compact version in a notes app or workplace security channel. Do not add private email content, passwords, verification codes, or confidential information.

V — View the complete sender address and Reply-To.
E — Examine exactly what the email wants me to do.
R — Review the link destination and file type without opening them.
I — Independently contact the real person or organization.
F — Flag urgency, secrecy, payment changes, or unusual procedures.
Y — Choose the safest action: report, delete, secure, escalate, or call the bank.

Why AI Phishing Emails Can Look Completely Real

Professional writing is now a weak authenticity signal. A suspicious email may use natural wording, correct punctuation, detailed context, a realistic signature, and the vocabulary of a manager, supplier, recruiter, family member, or customer.

That does not mean every polished message was generated by AI, or that every awkward message is fraudulent. It means writing quality cannot prove who sent the message. The FBI warns that sophisticated phishing messages may be well written and recommends independently confirming unusual requests.

AI detectors and chatbots cannot prove that an email is safe. A message may be human-written and malicious, AI-assisted and legitimate, copied from a real conversation, or sent from a compromised genuine account. Use AI observations as reasons to investigate—not as a final verdict.

Which Phishing Email Warning Signs Matter Most?

Learning how to check if an email is phishing is less about finding one typo and more about verifying the sender, request, destination, and surrounding context together.

High-Risk Combinations

• An unexpected message combined with a login link.
• A familiar display name combined with a different sender domain.
• An invoice combined with changed payment instructions.
• A security warning combined with a request for a password or verification code.
• A manager request combined with secrecy and a rushed payment deadline.
• A recruiter email combined with fees, identity documents, or software downloads.

When a suspicious message claims to come from an employer or hiring manager, follow the dedicated steps to verify a suspicious recruiter before uploading identification, paying a fee, installing software, or moving the conversation to an unfamiliar platform.

How to Check a Link in an Email Without Clicking It

1. Read the visible text. A button labeled “View Invoice” describes the promise, not the real destination.
2. Preview the destination. On a computer, hover over the link without clicking. Mobile mail-app behavior varies, so cancel immediately if an action would open the page.
3. Identify the controlling domain. In accounts.example.com.security-check.test, the controlling domain is security-check.test, not example.com.
4. Look for substitutions. Added words, extra hyphens, swapped letters, numbers replacing letters, and unfamiliar domain endings can imitate a genuine address.
5. Do not test the page. A malicious page may load normally, use HTTPS, and closely copy a legitimate login screen.
6. Navigate independently. Open the official app, use a trusted bookmark, or type the genuine website address yourself.

Phishing may also arrive through an event notification instead of a normal inbox message. When an unexpected event contains a payment warning, phone number, QR code, attachment, or meeting link, use the separate calendar invite phishing checklist.

How to Verify an Invoice, Payment, or Account Alert

Financial requests need a stronger verification standard. A message can appear inside an existing conversation, come from a compromised real mailbox, or use a display name that looks familiar.

1. Do not use the supplied payment link or phone number.
2. Open the real account independently. Check whether the invoice, transaction, renewal, or security alert appears there.
3. Compare the request with normal procedure. Is the amount, timing, account, contact person, and approval route expected?
4. Confirm changed payment details separately. Call a known number or speak to the person directly.
5. Escalate unusual business requests. Involve finance, management, or security before transferring money or changing supplier details.

The FBI recommends independently verifying payment requests and confirming any change in account numbers or payment procedures. Pressure to act quickly is a reason to slow down, not a reason to skip verification.

Copy-Ready Separate-Channel Verification Message

Send this only through a contact method you already trust. Do not reply to the suspicious email.

Hi [Name], I received an email that appears to be from you asking me to [describe the request]. Before I act, can you confirm through this known contact method whether you sent it and whether the details are correct? I have not clicked the link, opened the attachment, shared information, or made a payment.

Should You Paste a Suspicious Email Into AI?

A chatbot may help summarize the request, identify pressure language, or suggest questions that need verification. It cannot guarantee that the sender, link, attachment, invoice, or payment request is genuine.

Before using any AI service, remove or replace:

• Names, private email addresses, phone numbers, and physical addresses.
• Passwords, PINs, one-time codes, recovery codes, and login approvals.
• Live password-reset, account-verification, or invitation links.
• Bank, card, tax, government-ID, medical, student, or employment information.
• Confidential workplace messages, contracts, invoices, customer data, and attachments.

Review what not to share with ChatGPT before pasting a private message or uploading a suspicious file.

What to Do If You Already Clicked, Replied, or Paid

Act according to what happened. Stop communicating with the sender while you secure the account, device, identity, or payment.

If a password was exposed, secure the genuine account first. Then create a strong replacement password, store it in a trusted password manager, and do not reuse it on another account.

After a financial loss, be cautious of follow-up contacts promising guaranteed refunds or fund recovery. Learn how to avoid recovery scams after losing money before paying another fee or sharing more information.

How to Report a Phishing Email

Report Phishing in Gmail

1. Open the suspicious message without clicking its links or attachments.
2. Select the three-dot More menu beside Reply.
3. Select Report phishing.

Google explains that Gmail may display security warnings or move suspicious messages to spam, but the absence of a warning does not prove that a message is safe. See Google’s current phishing prevention and reporting guidance.

Report a Suspicious Workplace Email

Use your organization’s phishing-report button or follow its security process. Do not casually forward a dangerous attachment to coworkers. Preserve the original email and headers when your workplace policy requires them.

Report U.S. Consumer or Internet Fraud

• Report consumer fraud through ReportFraud.ftc.gov.
• Report internet-enabled crime through IC3.gov.
• Use IdentityTheft.gov

Two Fictional Phishing Email Examples Explained

Frequently Asked Questions

Final Rule: Verify Outside the Email

Knowing how to check if an email is phishing means moving the decision outside the message. A polished email can still be fraudulent, while a warning system can sometimes miss a dangerous message.

When an email asks for a login, code, download, reply, payment, or procedure change, inspect it, close it, and verify the request through a separate channel you trust.

Do not prove an email is real from inside the email.

Educational disclaimer: This guide provides general fraud-prevention and account-safety information. It is not legal, financial, banking, identity-theft, incident-response, or cybersecurity advice. Appropriate recovery steps depend on what was shared, the device and account involved, the payment method, timing, workplace policy, institution, and jurisdiction. Contact the relevant provider, financial institution, workplace security team, qualified professional, or government authority for help with a specific incident.