Easiest way: forward it
Forward the suspicious email to check@tapsafely.com. We read the sender details and links and reply with a risk level and advice. How email checks work.
Signs an email is phishing
- The sender name and address don't match. "PayPal Service" sent from a random Gmail or a strange domain.
- It's urgent. Your account is limited, a payment failed, or a parcel will be returned today.
- An invoice or renewal you don't recognise, often with a phone number to "cancel". This is a tech support scam.
- Links go somewhere else. Hover over a link (or long-press on a phone) to see the real address before tapping.
- Unexpected attachments, especially .html, .zip, .iso or documents that ask you to "enable content".
- A QR code asking you to log in. Scammers use QR codes to slip past email filters. Check a QR code.
How to see who really sent an email
- Gmail: tap the sender name, or open the three-dot menu and choose "Show original" on a computer.
- Outlook: hover over or tap the sender name to see the full address.
- Apple Mail: tap the sender name at the top of the message.
Look at the part after the @. A real company email usually comes from the company's own domain. Even then, don't use the links: open the app or website yourself.
How to report a phishing email
- Use your email app's Report phishing or Report junk button.
- In the UK, forward it to report@phishing.gov.uk.
- In the US, you can forward it to reportphishing@apwg.org (the Anti-Phishing Working Group), and report fraud to the FTC.
- Forward fake brand emails to the brand's own phishing address. Find it on our brand pages.
Questions people ask
Is it safe to forward a scam email to you?
Yes. Forwarding doesn't open links or attachments. We check the email and reply to you. We don't keep the email after checking.
Can an email hack me if I just open it?
Opening an email in an up-to-date app is very low risk. The danger comes from clicking links, opening attachments, or replying with details.
The email comes from the real company domain. Is it safe?
Usually, but accounts and systems can be hacked, and some tools let scammers send through real services. If the email asks for money or details, check in the app or website instead of using the links.
Why do scam emails get past my spam filter?
Scammers constantly change wording, use new domains, and hide links in images, PDFs or QR codes. No filter catches everything, which is why a second check helps.
I replied or clicked. What should I do?
If you shared a password, change it and turn on two-step verification. If you shared bank or card details, call your bank using the number on your card. Watch out for follow-up messages.