How to check a suspicious email safely

What phishing tries to make you do

Phishing is a form of social engineering that uses a deceptive message to prompt an unsafe action. The action might be revealing a password, granting app permissions, approving an unexpected login, opening a harmful file or paying an unverified recipient. Messages can arrive through email, texts, chats or calls.

In the game, the channels are represented as fictional emails so the evidence can be inspected safely. A real message can combine an accurate name or recent event with a false request. Those details make the approach convincing; they do not authorise the action.

Check the request through a different route

1. Identify what the sender wants you to do: share a secret, open something, grant access or send money.
2. Check whether you started the relevant action, such as placing an order or requesting a reset.
3. Open the service using your saved app or bookmark. For a sensitive work request, use an existing company contact or approval system.
4. Confirm new payment details through the established verification process. Do not replace that process with a number supplied in the email.
5. If the request cannot be verified, stop and report it through the organisation’s known process or the mail provider’s reporting control.

Read the complete hostname

Compare these fictional destinations:

• bank.example.com is a subdomain under example.com.
• bank.example.com.support.example.net is under example.net. The familiar name at the start does not change that.

HTTPS protects a connection; it does not establish that the destination belongs to the organisation you expected. A domain check is one piece of evidence. A genuine service or compromised sender can still deliver an unsafe request.

Keep account secrets private

Passwords, password-manager recovery kits, one-time authentication codes and session cookies can provide account access. Do not paste them into an unsolicited message or diagnostic request. Approve an MFA prompt only for a sign-in or action you initiated and understand.

In a workplace, follow the published support procedure. An instruction to disable protections, ignore a warning or keep a payment secret needs independent verification. It is particularly concerning when it also blocks normal approval routes.

If you already responded

• Use the real service’s app or known address to change an exposed password. Change it anywhere else you reused it.
• Review active sessions and revoke unfamiliar access or connected apps through the service’s own controls.
• Contact your organisation’s security team if a work account, device or company information is involved.
• Contact your bank or payment provider promptly through its established fraud channel if money or banking access is involved.
• Preserve relevant evidence and use the reporting process appropriate to your country and the affected service.

These are general first steps; the right response also depends on what was shared or opened.

Official guidance and further practice

• UK National Cyber Security Centre: how to spot a scam message.
• UK National Cyber Security Centre: what to do after sharing information.
• US CISA: phishing guidance (PDF).

Country-specific reporting channels differ. Follow the route for your own country or organisation. For practice without real messages or dangerous downloads, play the free game and compare the explained examples.