How to tell a real email from a fraudulent one
You cannot tell a fraudulent email from a real one by how it looks. Fraudsters now write in clean English, copy real logos and sometimes send from a genuine account they have taken over. What gives them away is what they ask you to do: pay a new account, sign in through a link, open an unexpected document or phone an unfamiliar number. Treat any of those requests as a reason to stop and confirm it through a channel you already trust.
This guide sets out the checks that work in 2026, the tricks they catch, and what to do if you have already clicked or paid.
Why email fraud is harder to spot than it was
Email fraud is a large and growing business. The FBI's 2025 Internet Crime Report, published in April 2026, recorded more than US$3 billion in losses to business email compromise, the fraud in which a criminal poses as a supplier, colleague or manager to redirect a payment. Phishing was again the most reported crime, with more than 191,000 complaints. In South Africa, the South African Banking Risk Information Centre (SABRIC) recorded 110,074 digital banking crime incidents in 2025, with gross losses of about R2.4 billion, mostly driven by social engineering rather than attacks on bank systems.
Three changes have made the old advice less useful:
- Spelling and grammar no longer give fraud away. The FBI, the US Cybersecurity and Infrastructure Security Agency (CISA) and the UK National Cyber Security Centre (NCSC) all warn that criminals use AI tools to write and translate fluent, personalised messages.
- The sender can be real. Microsoft reports that business email fraud usually starts with a stolen login. The criminal then replies inside a genuine email thread, so the message comes from the right address and quotes the right history.
- The first message often asks for nothing. Microsoft's 2026 Digital Defense Report counted more than 46 million business impersonation attacks in a year, and found that most first contacts are harmless openers such as "Are you at your desk?". The request for money or documents comes later, once you have replied.
The checks that work
1. Stop at any change of banking details
A supplier's new bank account, a "temporary" account for this payment only, or a colleague asking for salary to go to a different account: treat each as suspect until you have confirmed it. Phone the person on a number you already hold, from an earlier invoice, your contacts or their official website, never the number in the email. SABRIC's advice is the same: verify unusual payment instructions received by email, WhatsApp or phone through a trusted channel before any money moves.
2. Read the address, not the name
The name you see first, such as "Accounts Department" or your manager's name, can be set to anything. Look at the email address after it, letter by letter. The FBI gives the example of john.kelly becoming john.kelley. Watch for swapped letters (paypa1), extra words (yourbank-secure), and a different ending (.co instead of .co.za). A correct address is still not proof: a mailbox can be taken over, and a lookalike domain can pass every technical check, as the section on verified marks explains.
3. Ignore polish, notice pressure
Good grammar, a logo and a signature block prove nothing. Pressure does. Be wary of urgency ("today", "final notice"), authority ("the director needs this"), fear ("your account will be suspended") and secrecy ("keep this between us"). A real supplier or colleague will wait while you check.
4. Do not sign in through a link you did not expect
If an email says you must sign in, view a document or confirm your details, open the website yourself by typing its address or using a bookmark. On a computer, hover over a link to see where it really goes before you click. Fake "shared document", "please sign" and voicemail notifications are among the most common ways to steal logins, and Microsoft reports that some phishing kits capture your session as you sign in, so even a one-time code does not protect you.
5. Treat QR codes in email as links
A QR code in an email or attached PDF is a link you cannot read before you scan it, and it moves you from a work computer to a phone with fewer protections. Microsoft counted more than 145 million QR-code phishing attacks in a year. If a message asks you to scan a code to sign in, pay or "re-validate" an account, go to the service directly instead.
6. Never phone a number from an unexpected invoice or warning
Some fraudulent emails contain no link at all. They show an invoice or renewal you did not order and a number to call to cancel it. The person who answers then talks you into installing software or making a payment. Microsoft found that one in four impersonation emails tries to move you to a phone call. Find the company's number yourself.
7. Never paste a command to "prove you are human"
A page that asks you to press a key combination and paste something into the Run box, Terminal or PowerShell is attacking your computer. No real check works this way. Microsoft calls the technique ClickFix, and it is a common route for the password-stealing malware we explain in Saved passwords, stolen in seconds.
8. Know what real organisations never do
The South African Revenue Service (SARS) says it will never ask for passwords, one-time PINs (OTPs), banking PINs or eFiling login details by email, SMS or phone, will never ask for your banking details by email, and does not send links to other websites, even banks' websites. SABRIC says no bank will ask you to confirm or update your account details by email. An email that asks for any of these is fraudulent, whatever it looks like.
Common email fraud tricks and the check that catches each
| Trick | What it looks like | The check that catches it |
|---|---|---|
| Banking-detail change | A supplier's invoice with "our new account details" | Phone the supplier on a number you already have |
| Executive impersonation | "Are you at your desk? I need a quick favour" from your manager's name | Read the address; confirm by phone or in person |
| Hijacked thread | A reply in a real conversation that suddenly changes how to pay | Treat any payment change as suspect, whoever sends it |
| Fake document or signature request | "You have a document to review", "Please sign" | Open the service yourself, not the link |
| QR-code phishing | A PDF asking you to scan a code to keep access | Go to the service directly |
| Callback scam | An invoice you did not order, with a number to cancel it | Find the company's number yourself |
| "Verify you are human" | A page asking you to paste a command | Close the page; no real check does this |
| Tax and bank impersonation | A SARS refund or bank "security update" | SARS and banks never ask for logins or banking details by email |
What verified marks and security checks mean
Mail services check three technical records when a message arrives. Sender Policy Framework (SPF) checks that the sending server is allowed to send for the domain. DomainKeys Identified Mail (DKIM) checks a digital signature showing the message was not changed on the way. Domain-based Message Authentication, Reporting and Conformance (DMARC) ties those checks to the address you see in the From line.
These records stop a criminal sending mail that claims to come from your exact domain. They do not tell you the message is honest. The current DMARC standard says so itself, and states that lookalike domains and display names are outside its scope. Microsoft's documentation adds that a fraudster who registers a lookalike domain and publishes valid records can pass all three. A mailbox that has been taken over passes them too.
Gmail sometimes shows a brand logo and a blue checkmark next to a sender. That means the company has proved it owns the domain and the logo. It says nothing about the request inside the message, and most genuine suppliers will never have one, so its absence means nothing either.
How to see who really sent an email
- Thunderbird: the message header shows the sender. To see the full address and every header, open More > Customize in the message header, or More > View Source (Ctrl+U) for the complete message.
- Gmail on the web: click the small arrow under the sender's name to see "Mailed by" and "Signed by". For the full header, open More (three dots) > Show original.
Our help article How to find and read full email headers covers other mail programs and explains what the lines mean. For a checklist you can keep beside you, see How to identify spam and phishing emails.
Put a payment rule in place
The most effective protection against payment fraud is a rule your business follows every time, so nobody has to judge each email alone. The Australian Signals Directorate recommends an approval process for any change of payment details and for large transfers. A simple version:
- Any new or changed bank account is confirmed by phone, on a number already on file, before it is used.
- A second person approves the change.
- Nobody is penalised for delaying a payment to check it.
Tell your suppliers and clients about the rule too. A fraudster who poses as your business will find it harder if your clients know you never change banking details by email.
If you clicked or paid
- If you paid: phone your bank immediately and ask it to recall the payment. The FBI says time is critical: in 2025 its recovery team froze 58% of the money in the cases it acted on.
- If you entered a password: change it from a different, clean device, sign out all other sessions, and check your mailbox for forwarding rules and filters you did not create.
- If you opened an attachment or ran a command: stop using that computer and have it checked before you sign in to anything on it.
- Report it. Forward SARS-themed emails to [email protected]. If your mail is hosted with Noiz, forward the email to Noiz support as an attachment, so the full headers come with it.
Stop criminals sending as your domain
Your own domain can be used against your clients if it is not protected. SPF, DKIM and DMARC, set up correctly, stop criminals sending mail that claims to come from your exact address. Our help article How to protect your domain from spoofing explains how. For a domain hosted with Noiz, the Email Security add-on keeps those records configured and adds spam and virus filtering. If you are unsure whether an email you received is genuine, or want help protecting your domain, get in touch with Noiz support.
Sources
Checked 19 October 2026.
Fraud figures and techniques
- FBI: Business email compromise
- FBI IC3: 2025 Internet Crime Report (released 6 April 2026)
- FBI IC3: Criminals use generative AI to facilitate financial fraud (3 December 2024)
- SABRIC: Annual Crime Statistics Report 2025 (4 August 2026)
- SABRIC: How to stay safe
- Microsoft Digital Defense Report 2026 (1 October 2026)
- Microsoft Digital Defense Report 2025
- Microsoft: Email threat landscape, Q2 2026
- CISA: Recognize and report phishing
- NCSC: Spotting scams
- NCSC: The near-term impact of AI on the cyber threat (January 2024)
- Australian Signals Directorate: Learn about account compromise
South Africa
Email authentication
- RFC 9989: DMARC (May 2026)
- RFC 7208: SPF
- RFC 6376: DKIM
- Microsoft Learn: Anti-phishing policies
- Google: Check if your Gmail message is authenticated
- Google: Trace an email with its full header
- Google Workspace: Set up BIMI
- Mozilla: Thunderbird keyboard shortcuts
Noiz
- How to identify spam and phishing emails
- How to forward an email as an attachment
- How to find and read full email headers
- How to protect your domain from spoofing
- Email Security add-on
Note: while some of this content was produced with the help of AI, the final editing has been done by a real human being.
