Is this email a scam?
Paste a suspicious email below. This free email scam checker reads the sender's address for spoofing tells, flags the red flags phishing emails rely on, and explains the tactic behind each one. Use it as a quick phishing email checker or scam email checker whenever you're asking "is this email legit?" — no signup, and nothing is uploaded. It reads what you paste; it can't confirm who owns an email account.
🔒 Checked entirely in your browser — the email is never uploadedThis is a pattern-based checker, not a verdict from your email provider or IT team. A clean result does not guarantee an email is safe — new phishing appears daily, and the most targeted attacks avoid common tells. When in doubt, contact the company or person directly using a website or number you already have, never one from the email. Already clicked, entered a password, or paid? Use our what-to-do-now tool.
Got a suspicious text instead? Run it through our free SMS scam checker — or check just where a link really goes →
How to check an email
- Copy the subject line and the message text. Leave out passwords, verification codes, and personal details you don't need to share.
- Open the sender details in your mail app and copy the full sender — display name and address. Add the Reply-To only if your app shows one.
- Press Check this email, read the reasons, and verify any request through a website, app, or phone number you already trust.
This works with text copied from Gmail, Outlook, Apple Mail, Yahoo, or any other mail app — nothing connects to your inbox. If your app can show the original message with its headers (Gmail calls this “Show original”), you can paste those too.
What this checker checks
What it looks at
- The sender. A display name that names a brand the address doesn't belong to, a “company” on a free email account, look-alike or machine-generated addresses, risky domain endings, and a Reply-To that sends your answer somewhere else.
- The links. Shortened links that hide the destination, look-alike and disguised domains, raw IP addresses, and risky domain endings. It reads the links; it doesn't open them.
- The wording. About 30 patterns fraud relies on — urgency and threats, requests for passwords, codes, or payment, gift cards and crypto, changed bank details, a boss's “quick task,” fake shared documents, and more.
- Pasted headers. If you include them, it reads your mail server's own SPF, DKIM, and DMARC results and flags any that failed.
Each red flag comes with the reason it matters and the persuasion tactic behind it.
What it can't do
- It can't prove who owns a Gmail or any other email account.
- Pasted text can't prove where an email really came from — only the receiving mail server can check that.
- It doesn't scan attachments or connect to your inbox.
- A clean result doesn't guarantee an email is safe.
Want deeper checks? This free tool runs entirely in your browser, so it only sees what you paste. With a Solo or Family plan, you can forward a suspicious email to check@scamdrill.com from an address on your ScamDrill account. Our servers then read the full forwarded email, follow shortened links to their real destination, check how recently the sender's domain was registered, and add an AI second opinion on borderline cases.
Get this on your phone. The ScamDrill app runs the same check from your share sheet — paste, share, or screenshot. Free on iPhone and Android; the full checkers come with a Family plan.
Real scam email examples (and the tell in each)
These are the patterns behind the emails most people paste into the checker. Learn the one tell in each and you’ll catch the next one without any tool.
“Microsoft 365: Your password expires today. Re-verify now to keep access to your account: micros0ft-verify.com”
🚩 Why it’s a scam: Hover the link before clicking — the domain isn’t microsoft.com (note the zero in “micros0ft”). Real password changes happen inside your account settings, never through an emailed link with a deadline.
“Re: Outstanding invoice #4471 — kindly process the wire today. Updated bank details attached.” (from accounts@yourvendor-billing.com)
🚩 Why it’s a scam: Check the sender’s domain character by character. Business email compromise uses look-alike domains (an added word like “-billing,” or “rn” for “m”) plus urgency to redirect a real payment. Verify new bank details by calling a number you already have.
“Amazon: We couldn’t ship your order because your payment was declined. Confirm your card details to release it: [link]”
🚩 Why it’s a scam: Retailers don’t ask you to re-enter card details through an email link. Go to the retailer’s site or app directly — the “declined payment” is bait to capture your card.
“I know your password is ******. I installed malware and recorded you. Send $1,900 in Bitcoin within 48 hours or I send the video to your contacts.”
🚩 Why it’s a scam: The password was leaked in an old data breach and reused to scare you — there is no video. It’s a mass-sent bluff. Don’t pay; change any password you reused and turn on two-factor authentication.
“Congratulations! You’ve been selected for a remote data-entry position at $35/hr. To onboard, send your bank details for direct deposit and a refundable $200 equipment deposit.”
🚩 Why it’s a scam: No real employer hires without an interview or asks you to pay for equipment. The “refundable deposit” and the request for bank details up front are the theft.
Next time, spot it without a checker.
ScamDrill sends safe practice emails and texts to your family so the instincts are there before the real phishing arrives. Paid plans also include forward-an-email verdicts with link expansion, new-domain detection, and sender-authentication checks built in. Free plan available — and you've just seen exactly which tactics need practice.
Start practicing free →Get a heads-up before the next scam reaches you
Join our free newsletter — monthly scam-trend updates and practical tips to protect yourself and the people you care about. No spam, unsubscribe anytime.
We'll only use your email to send scam alerts. See our privacy policy.
FAQ
Email scam questions, answered
How can I tell if an email is a scam?
chase-secure.info, or a Reply-To that points somewhere else). Watch for urgency, threats, account-problem pretexts, requests for passwords or codes, unexpected attachments, and links that don't go to the company's real website. The checker above scores an email against these patterns instantly. For a deeper walkthrough, see how to spot common scams.