Is this email a scam? Start with these 7 safe checks

This is a first-pass routine you can use in about 60 seconds. It is not a guarantee. No single red flag proves fraud; no absence of red flags proves safety.

1. Were you expecting it?

Unexpected invoices, delivery problems, refunds, account locks and shared documents all deserve a pause. A message can still be dangerous when you use the named organisation or were expecting a parcel.

Ask yourself: did I start this transaction or conversation? Does the timing make sense? If you have never had the account, do not use the message to create one.

2. What does it want you to do?

The requested action often tells you more than the design. Be cautious when an email asks you to:

• open a link, attachment or QR code;
• sign in or provide a password or one-time code;
• pay an invoice, buy gift cards or change bank details;
• call a number supplied in the message;
• reply with identity or financial information; or
• install an app, browser extension or remote-access tool.

Cyber.gov.au: learn about phishing scams explains that phishing can imitate trusted organisations and try to steal passwords, bank details or account access. The request may arrive by email, text, call or social message.

3. Does it pressure or threaten you?

Deadlines, account closure, fines, legal threats and claims that money is about to leave your account are designed to shorten your thinking time. A genuine organisation can have deadlines too, so urgency alone is not the whole test. It is a reason to slow down and verify independently.

4. Who is the actual sender?

Open the sender details and look beyond the display name. A label such as “myGov” or “Australia Post” can sit above a completely unrelated address. Watch for free webmail used for an organisation, misspellings, extra words and unexpected subdomains.

Do not stop there. Scamwatch says addresses can be copied or “spoofed”, and a genuine service can sometimes be abused to send a fraudulent invoice. An official-looking domain is evidence to consider, not a safety verdict.

5. Where does a link claim to go?

A button saying “View your statement” can lead somewhere unrelated. On a computer, hovering over a link may reveal its destination; on a phone, inspecting it without opening it can be less obvious.

• Do not open a link just to test it.
• Do not copy an unknown address into your browser.
• If you are comfortable inspecting links, use your email app’s safe preview or copy the link into a plain-text editor—not a browser—to read it.
• Be wary of shortened links and lookalike domains. The organisation’s real domain should be the actual destination, not merely text inside a longer address.

Vision Australia: check addresses and links with a screen reader has step-by-step screen-reader advice for revealing the full sender address and reading a link in Notepad or TextEdit. If this feels awkward or risky, skip the inspection and use the official app instead.

6. Can you verify independently?

Close the email. Open the organisation’s official app, type a known website address yourself, or find a contact number from a trusted source. For a bank, the number on the back of your card is a good option.

Do not use a phone number, link or reply address supplied by the suspicious message. Scamwatch: email scams recommends contacting the organisation using details you found yourself and entering its secure portal or app directly.

7. Do the facts match your own account?

Check the order, subscription, parcel or government inbox through the normal service. Does the item exist? Does the amount match? Did you ask for the document or refund?

No matching transaction can support your suspicion, but it does not identify exactly who sent the email. A matching delivery also does not make an extra “redelivery fee” safe. Verify the specific request, not just whether you use the service.

Three Australian examples

Subject: Payment complete for Home Security Premium

An invoice for $649.00 has been issued to you.
Call [fictional phone number] within 24 hours if this was not you.

Subject: Your myGov account is locked

We noticed suspicious activity. Click the secure link to unlock your
account and confirm your sign-in details:
hxxp://example[.]invalid/mygov

Subject: Attempted delivery — action required

We could not deliver your parcel. Confirm your address and pay the
redelivery fee using this link: hxxp://example[.]invalid/parcel

All destinations above use the reserved .invalid domain and are deliberately non-working. They are fictional teaching examples, not screenshots of customer submissions.

What not to rely on

• A familiar logo, colour scheme or professional layout.
• Your real name, address or other details—scammers may already have them.
• Perfect spelling and grammar, or one spelling mistake as the only test.
• A sender name, address or text-message thread that looks genuine.
• A padlock on the destination page; it only describes a connection, not honest intent.
• A scanner’s “safe” answer or the absence of obvious red flags.

What to do if you are still unsure

Leave the message alone while you check. Ask a trusted person or forward it to check@askscam.com for a second opinion. Avoid forwarding suspicious attachments when a text description or safe screenshot will do, and never include passwords, card numbers or codes.

AskScam’s answer is not proof. If money or personal information is at stake, use the organisation’s official app or contact route as well.

If you already clicked, shared details or paid

A checklist to save or print

• Was I expecting this?
• What action is it asking for?
• Is it creating pressure or fear?
• Who is the full sender—not just the display name?
• Can I avoid the link and inspect it safely?
• Can I check in the official app or through independently found details?
• Does the request match my own account activity?

Use your browser’s Print function for a clean text version. Keep this routine; do not treat it as a certification that a message is safe.