How to tell if an email is fake

Fake emails (phishing) are built to look exactly like the real thing: the right logo, colours and wording. So don’t judge by looks. These eight checks catch nearly all of them, and the last one gives you a definite answer in under a minute.

1. Look at the real email address, not the name

The name (“FNB”, “SARS eFiling”, “Microsoft 365”) can be anything. Tap or hover over it to see the address. alerts@fnb.co.za can be real; fnb.alerts@gmail.com or noreply@fnb-secure-verify.com is not. Banks, SARS and big companies never send from Gmail, Outlook.com or Yahoo addresses.

2. Check the domain letter by letter

Scammers register look-alikes: capitec-bank.co, rnicrosoft.com (r+n instead of m), takealot-sale.shop. Everything just before the last dot must be the company’s real name, e.g. …@capitecbank.co.za. Not sure? Paste the domain into the website legit checker: a domain registered a few weeks ago is a giveaway.

3. Hover before you click

On a computer, rest the mouse on a button or link and look at the address shown at the bottom of the window. On a phone, press and hold the link and choose Copy. If it doesn’t go to the company’s own website, don’t open it. Short links (bit.ly and similar) can be expanded safely with the redirect checker.

4. Urgency and threats

“Your account will be closed in 24 hours”, “payment failed”, “unusual sign-in”, “parcel held: pay R25 customs fee”. Real companies rarely give you hours to act, and never ask you to confirm details by clicking an email link.

5. Requests for passwords, OTPs, PINs or card details

No bank, SARS, SASSA, courier or IT department will ever ask for your OTP or PIN by email. Any email that leads to a “log in to confirm” page should be treated as fake until proven otherwise. Open the app or type the website address yourself instead.

6. Changed banking details on an invoice

A very common South African business scam: a supplier’s “new bank account” email, often from a hacked or look-alike address and sometimes inside a real email thread. Always phone the supplier on a number you already have (not one in the email) before paying to new details.

7. Attachments you didn’t expect

Unexpected invoices, “statements”, voice-mail notifications, and HTML, ZIP or “.pdf.exe” files are a classic way to install malware or show a fake login page. Don’t open them; ask the sender through another channel.

8. The definite check: read the email headers

Every email carries hidden headers. When it arrives, your provider records whether it passed SPF, DKIM and DMARC, the checks that prove the email came from the domain in the From line. Copy the headers (how to find them in Gmail, Outlook, Apple Mail and Yahoo) and paste them into the email header analyzer. You’ll see:

whether it really came from that domain (DMARC pass) or was faked,
whether replies are secretly sent to a different address,
whether the sender name pretends to be a bank or company it isn’t,
the servers it passed through and the sending server’s country.

A pass proves the domain is genuine, not that the domain is honest, so combine it with checks 1 and 2.

I already clicked or replied. What now?

Typed a password? Change it now on the real website, and anywhere else you use it. Turn on two-step verification.
Gave card or banking details, or an OTP? Call your bank’s fraud line immediately (the number on the back of your card).
Opened an attachment? Disconnect from the internet and run a full antivirus scan; at work, tell IT straight away.
Report it: use “Report phishing” in Gmail or Outlook, and forward bank scams to your bank’s phishing address.

More steps in what to do if you’ve been scammed.

Frequently asked questions

Can a scam email come from a real company address?

Yes, in two cases. Either the company’s email account was hacked (so it passes every check), or the company’s domain has no DMARC protection, so scammers can fake its address. Use the SPF & DMARC checker to see whether a company’s domain is protected, and be extra careful with payment requests.

Is it dangerous just to open a fake email?

Opening and reading it is very low risk in modern email apps. The danger is clicking links, opening attachments, replying, or giving details. If you only opened it, delete it and report it as phishing.

How do I report a phishing email in South Africa?

Use the “Report phishing” or “Report junk” button in your email app, and forward bank-related phishing to your bank (most SA banks list a phishing reporting address on their website). If you lost money, report it to your bank and open a case at SAPS.