Example result
A sample written for this page: an email with a From name of "PayPal Support" sent from paypa1-secure.com, a Reply-To at another domain, a failed spf and dmarc result, a link whose text shows www.paypal.com but opens a number address, and an attachment named Statement.pdf.exe
- Assessment
- high risk
- Confidence
- high (6 kinds of signal)
- Signals matched
- 13, score 25
- Signal 1
- A link that goes to a number address instead of a name: http://203.0.113.9/login
- Signal 2
- Link text that shows one site but points to another: shows www.paypal.com, opens 203.0.113.9
- Signal 3
- Mentions a program, script or disk image file: Statement.pdf.exe
- First step
- Do not click any link, call any number in it, open any attachment, or send codes, money or personal details.
Captured 2026-10-19.
How it works
- Copy the email into the box. If your mail app can show the original message or full headers, paste those first and the body after them.
- Press the button. The checker splits the headers from the body, compares the sender fields, and reads the body and every link against its rules.
- Read the risk band, the signals behind it and the steps for your result. Sender checks appear only when headers were pasted.
What the checker looks for
Pressure and threats: urgency or a short deadline; threat of arrest, legal action or a shutdown.
Impersonation: package delivery problem or a small fee to release it; unpaid toll, fine or violation; names a well-known organization and carries a link; generic greeting instead of your name.
Account problems: account problem, suspicious activity or an expiring password.
Requests for codes and details: asks for a password, card number or other personal detail; asks you to send or read out a one-time code or PIN.
Payment demands: asks for payment or codes from gift cards; asks for a wire transfer, crypto or a payment app; asks for a fee up front before money or a loan is released; a charge or renewal you did not make, with a number to call; invoice, receipt or payment notice you did not expect.
Prizes, refunds and job offers: a prize, refund, inheritance or unclaimed money.
Moving you elsewhere: asks you to keep it secret; tells you to call a number about a charge, order or account.
Tech support and remote access: asks you to install or allow remote access software; a virus or hacking warning with a number to call.
Link tricks: a shortened link that hides the real address; a link that goes to a number address instead of a name; a link written with look-alike international characters; a link with an "@" that shows a trusted name before the real site; a link ending in an uncommon domain ending such as .top or .xyz; a link whose domain is spelled like a well-known brand; link text that shows one site but points to another.
Risky attachments: mentions a program, script or disk image file; mentions an archive, web page or macro file.
Sender and header mismatches: sender name shows one address but the mail comes from another; sender name uses a well-known brand but the address belongs elsewhere; sender domain is spelled like a well-known brand; replies go to a different domain than the sender; bounce address uses a different domain than the sender; the mail servers recorded a failed SPF, DKIM or DMARC check; the sender checks came back soft, neutral or empty; full headers were pasted but carry no sender check result.
Pasting headers
Headers are the lines at the top of an email, such as From, Reply-To, Return-Path, Subject and Authentication-Results. Long headers are often wrapped onto several lines, and the checker joins them back together before reading.
The sender checks depend on the headers you paste. With no header block, only the wording, links and attachments are read. With a few lines such as From and Subject, the sender name and domain are compared. Authentication results, which are the spf=, dkim= and dmarc= values your mail server wrote, are read only when they are in the text, and a missing result is reported only for a full header dump.
How the result is worked out
Every rule that matches adds its weight, 1 to 3, to a total. A total of 0 reads "no indicators found", 1 to 2 reads "low risk", 3 to 5 reads "medium risk", and 6 or more reads "high risk".
A few rules carry a floor. Asking for gift card payment, an up-front fee to release money, or remote access to your device lifts any result to at least medium risk. Asking you to read out a one-time code does the same when the message also contains a link.
Confidence is a band, not a percentage. It counts how many different kinds of signal matched: one kind is low, two is medium, three or more is high. A result of "no indicators found" always has low confidence, because patterns cannot prove who sent a message.
The text is matched with fixed rules and runs in your browser. Nothing is sent anywhere, and the same text always gives the same result.
Why these patterns
The FTC advises that if an email or text from a company you do business with seems real, it is still best not to click its links, and to contact the company through a website you know is trustworthy or a phone number you look up yourself. The rules here turn that advice into checks: whether the sender is who it says, whether a link goes where it claims, and whether the message pressures you.
A result of "no scam indicators found" only means none of the rules matched. It does not say who sent the email.
Every signal the phishing email checker reads, with its weight
| What it looks for | Kind of signal | Weight | Why it matters | What to do |
|---|---|---|---|---|
| Urgency or a short deadline | Pressure and threats | 1 of 3 | Scammers want you to act before you have time to think or check. A real organization gives you time to decide. | Pause. A deadline in a message is a reason to check, not to hurry. |
| Threat of arrest, legal action or a shutdown | Pressure and threats | 2 of 3 | Threats of arrest, a lawsuit or losing a service are used to scare people into paying or sharing details. | Do not respond to the threat. Contact the organization on a number or site you already know. |
| Package delivery problem or a small fee to release it | Impersonation | 2 of 3 | Fake delivery notices ask for a small fee or an address fix, which sends you to a page that collects card details. | Track the package from the carrier or store you ordered from, by typing its address yourself. |
| Unpaid toll, fine or violation | Impersonation | 2 of 3 | Messages about an unpaid toll, ticket or fine push you to a payment page before you can check whether you owe anything. | Look up the balance on the toll or court site you find yourself, never through the message. |
| Names a well-known organization and carries a link | Impersonation | 1 of 3 | Scammers borrow the name of a bank, carrier, government office or online store so the link looks expected. | Open the organization's own app or site by typing its address, then look for the same notice there. |
| Generic greeting instead of your name | Impersonation | 1 of 3 | Mass messages open with a general title because the sender does not know who you are. | Treat a message that does not use your name with extra care, especially when it asks for something. |
| Account problem, suspicious activity or an expiring password | Account problems | 2 of 3 | A made-up account problem is the most common way to get you to click a link and sign in on a fake page. | Do not sign in through the message. Open the real app or site yourself and look for alerts there. |
| Asks for a password, card number or other personal detail | Requests for codes and details | 2 of 3 | An organization that already holds your account does not ask for your password or full card details by message. | Never send these details in reply. If the request might be real, contact the organization through its own site or app. |
| Asks you to send or read out a one-time code or PIN | Requests for codes and details | 2 of 3, with a link lifts the result to at least medium | A one-time code proves it is you. Whoever gets it can sign in as you or approve a payment. | Never share a code with anyone who contacted you. Close the conversation and contact the service yourself. |
| Asks for payment or codes from gift cards | Payment demands | 3 of 3, lifts the result to at least medium | Gift card numbers work like cash and cannot be pulled back. The FTC lists gift cards among the ways scammers insist on being paid. | Do not buy gift cards for anyone who contacted you. If you already did, call the card company right away. |
| Asks for a wire transfer, crypto or a payment app | Payment demands | 2 of 3 | Wire transfers, cryptocurrency and payment apps are hard to reverse, which is why scammers ask for them. | Do not send money to anyone who contacted you first. Confirm the request with a person you already know. |
| Asks for a fee up front before money or a loan is released | Payment demands | 3 of 3, lifts the result to at least medium | The FTC describes advance-fee loan scams: you are told to pay a "processing" or similar fee first, and there is no loan. | Do not pay a fee to receive money or credit. Walk away and do not send anything. |
| A charge or renewal you did not make, with a number to call | Payment demands | 2 of 3 | Fake invoices and renewals make you worry about a charge, then send you to a phone number or page that asks for your details. | Check your real account or card statement. Do not call the number in the message. |
| Invoice, receipt or payment notice you did not expect | Payment demands | 1 of 3 | An unexpected invoice or remittance notice is a common reason to open an attachment or a link. | Check with the person or company you do business with by phone before opening it. |
| A prize, refund, inheritance or unclaimed money | Prizes, refunds and job offers | 2 of 3 | The FTC lists a prize or a problem as a common first move. Winning something you never entered, or a refund you did not ask for, is a way in. | Do not pay anything to claim a prize or refund. Real winnings do not ask for money first. |
| Asks you to keep it secret | Moving you elsewhere | 2 of 3 | Secrecy keeps the people who could stop the scam, such as family or your bank, from hearing about it. | Tell someone you trust right away. Anyone who asks for secrecy about money is a reason to stop. |
| Tells you to call a number about a charge, order or account | Moving you elsewhere | 2 of 3 | A callback number in the message leads to a scammer, who can then ask for details over the phone. | Use the number printed on your card or the organization's own site, not the one in the message. |
| Asks you to install or allow remote access software | Tech support and remote access | 3 of 3, lifts the result to at least medium | The FTC describes tech support scams: the caller asks for remote access to your computer, then claims to find a problem to charge you for. | Do not install it or give access. Disconnect, and contact the company through the number on its own site. |
| A virus or hacking warning with a number to call | Tech support and remote access | 2 of 3 | Pop-ups and messages claiming your device is infected and telling you to call are how tech support scams start. | Close the page or restart the device. Do not call the number shown. |
| A shortened link that hides the real address | Link tricks | 1 of 3 | A short link hides where it goes until you open it. | Do not open it. Ask the sender for the full address, or look the organization up yourself. |
| A link that goes to a number address instead of a name | Link tricks | 3 of 3 | Real organizations use their own names in links. A bare number address is a sign the page was set up in a hurry. | Do not open it. |
| A link written with look-alike international characters | Link tricks | 2 of 3 | Domain names written with look-alike letters from other alphabets can read like a familiar name while pointing elsewhere. | Do not open it. Type the organization's address yourself. |
| A link with an "@" that shows a trusted name before the real site | Link tricks | 3 of 3 | In an address like trusted-name.com@other-site.com, everything before the @ is ignored and the real destination is the part after it. | Do not open it. |
| A link ending in an uncommon domain ending such as .top or .xyz | Link tricks | 1 of 3 | This is a weak signal on its own, since honest sites use these endings too. It adds weight when other signals are present. | Compare the address with the organization's real site before you open it. |
| A link whose domain is spelled like a well-known brand | Link tricks | 3 of 3 | One changed letter, a number in place of a letter, or a brand name with words added can pass for the real site at a glance. | Do not open it. Type the real site's address yourself. |
| Link text that shows one site but points to another | Link tricks | 3 of 3 | The words you see on a link and the address it opens are set separately. A mismatch means the visible name is bait. | Do not click. Type the address you expected into your browser. |
| Mentions a program, script or disk image file | Risky attachments | 3 of 3 | Files such as .exe, .scr, .js or .iso run code when opened. A real invoice or document does not need to. | Do not open the file. Delete the message. |
| Mentions an archive, web page or macro file | Risky attachments | 1 of 3 | Archives, saved web pages and macro-enabled files are often used to carry something unexpected. They are common in honest mail too, so the weight is small. | Open nothing you did not expect. Confirm with the sender by phone first. |
| Sender name shows one address but the mail comes from another | Sender and header mismatches | 3 of 3 | The name in front of an email address can be set to anything, including a different address. | Judge the message by the actual address, not the name shown. |
| Sender name uses a well-known brand but the address belongs elsewhere | Sender and header mismatches | 2 of 3 | Anyone can put a brand name in the sender name. The address after it shows who really sent the mail. A small business that shares a brand's name can trip this rule. | Check the address itself and compare it with the organization's real site. |
| Sender domain is spelled like a well-known brand | Sender and header mismatches | 3 of 3 | A changed letter, a digit in place of a letter, or a brand with extra words around it can pass for the real sender at a glance. | Do not reply or click. Contact the organization using its real site. |
| Replies go to a different domain than the sender | Sender and header mismatches | 2 of 3 | When the Reply-To address differs from the From address, your answer goes to someone other than the apparent sender. | Do not reply. Write to the organization using an address you found yourself. |
| Bounce address uses a different domain than the sender | Sender and header mismatches | 1 of 3 | Mailing services often do this for honest mail too, so the weight is small. It adds up when other sender signals are present. | Look at the other sender checks first. |
| The mail servers recorded a failed SPF, DKIM or DMARC check | Sender and header mismatches | 3 of 3 | These results are what the receiving server wrote down when it checked the sender. A fail means the message did not prove it came from the domain it claims. The result depends on the headers pasted. | Treat the message as unproven. Do not click or reply. |
| The sender checks came back soft, neutral or empty | Sender and header mismatches | 1 of 3 | A soft fail, neutral or "none" result means the domain did not clearly vouch for the message. The result depends on the headers pasted. | Read it together with the other sender checks. |
| Full headers were pasted but carry no sender check result | Sender and header mismatches | 1 of 3 | Only a full header dump can show whether the sender checks passed. This applies only when the pasted headers include route lines such as Received. | Copy the full original headers from your mail app if you want this check. |
Sources
- FTC Consumer Advice: How To Avoid a Scam read 2026-10-19
- FTC Consumer Advice: How To Recognize and Report Spam Text Messages read 2026-10-19
This tool is run by LookValid. It is not connected to any agency, company or service named on this page.
Frequently asked questions
How do I get the full headers of an email?
Most mail apps have an option such as "show original", "view source" or "view message details" on the message menu. Copy what it shows, which starts with lines such as Received and From, and paste it above the body.
Does the checker send my email anywhere?
No. The rules run inside your browser and the page makes no request with your text. Links and attachments mentioned in the email are only read as text and are never opened.
Why does it say it needs headers for the authentication check?
The spf, dkim and dmarc results are lines your mail server added to the message. They are not in the visible body. Without the headers there is nothing to read, so the check is skipped and the result says so.
The sender name looks right. Why was it flagged?
The name before an email address can be set to anything. The checker compares it with the address and flags a name that shows another address or a well-known brand the address does not belong to. A small business that shares a brand's name can trigger this, so read it with the other signals.
What should I do with a phishing email?
Do not click, reply or open attachments. Report it as phishing or junk in your mail app, report it at ReportFraud.ftc.gov, and delete it. If you already signed in on a page it linked to, change that password from the real site.