You Got a Warning. Here's What to Do:
- Don't reply, click links, or send money
- Call the sender at a number you find yourself — not from the email
- When in doubt, delete it
17 Tactics Scammers Use
Recognize the tricks — here's what we scan for, ranked by severity.
Invisible Character Tricks
Identical to your eyes. Different to computers.
The Cyrillic letter "а" looks exactly like the English letter "a" — but to a computer, they're completely different characters. Criminals swap these lookalike letters to create email addresses that are visually perfect forgeries. You literally cannot see the difference.
You receive an email from "accounts@microsoft.com" — except that "о" in microsoft is Cyrillic, not English. Your eyes see Microsoft. The email looks legitimate. You reset your password through their fake link, and they now control your account.
Human eyes cannot distinguish between these characters. They look identical. Only software scanning the actual character codes can detect the substitution.
Your eyes cannot detect this. Only software can.
Reply-To Hijacking
Your reply goes to them, not who you think.
The "From" address looks legitimate — maybe even your CEO's real email. But hidden in the email header is a different "Reply-To" address. When you hit reply, your response goes straight to the scammer, not the person you think you're emailing.
You get an email that appears to be from your boss asking you to process a vendor payment. You reply with questions, they answer convincingly, and you send the wire. You had a whole email conversation. But every single reply went to a criminal in another country who was pretending to be your boss.
This attack is completely invisible in normal email use. The "From" line shows your boss's name and email. You have to manually inspect the email headers to see the reply-to mismatch — and nobody does that.
From: ceo@yourcompany.com
Reply-To: ceo-yourcompany@gmail.com
You think you're emailing your CEO. You're emailing a criminal who now has whatever you sent them.
Lookalike Email Addresses
One character. Total impersonation.
Criminals create email addresses nearly identical to someone you trust — your bank, your boss, your escrow officer, your client. They change one letter, add an extra character, or swap an "l" for a "1." You glance at it, it looks right, so you trust it.
An escrow officer gets an email from "the seller" asking to change the wiring instructions for their proceeds. The email address is off by one character — sara.milller@gmail.com instead of sara.miller@gmail.com. Who checks for three L's? The officer wires $380,000 to a criminal's account. Within hours, the money hops through a chain of banks and lands overseas. It's gone.
Most security tools compare against a generic database. We compare incoming emails against YOUR actual contacts. If you've emailed sara.miller@gmail.com before and suddenly get an email from sara.milller@gmail.com, we flag it immediately. The closer the match, the more likely it's an impersonation attempt.
Display Name Spoofing
The name you trust, the address you ignore.
Email programs show the sender's display name prominently — "Bank of America Security" or "IT Support" or "DocuSign" — while hiding or minimizing the actual email address. Criminals set any display name they want, regardless of what address they're actually sending from.
Your inbox shows an email from "Chase Fraud Department." You open it, concerned about your account. But the actual sending address is xr7829@randomserver.net. You click the link, enter your banking login, and they drain your account.
We flag emails where the display name contains trusted company keywords or official-sounding phrases but the actual email domain doesn't match. If someone calls themselves "PayPal Support" but emails from a Gmail address, that's a red flag.
In your inbox: "Bank of America Security"
Actual address: xr77281@randomdomain.com
In your inbox: "DocuSign"
Actual address: notreal@spamserver.net
Dangerous Keywords
The language of fraud.
Scam emails use specific phrases designed to pressure you into acting before you think. They create urgency, threaten consequences, impersonate authority figures, or request sensitive financial actions. These aren't random — they're proven manipulation tactics.
You receive an email saying "Your account will be suspended in 24 hours" or "Updated wire instructions — please confirm receipt." The urgency makes you act fast. You send money or credentials without verifying, and it's gone.
Over 90 phrases across six categories:
Wire Fraud Terms
"Wire transfer," "routing number," "bank account details," "updated wire instructions," "ACH transfer"
Urgency Tactics
"Act now," "urgent action required," "account suspended," "expires today," "last chance"
Authority Impersonation
"CEO request," "CFO request," "boss asked," "owner request," "executive request"
Financial Verification
"Verify your account," "confirm your identity," "update payment method," "unusual activity"
Inheritance & Lottery Scams
"Beneficiary," "unclaimed funds," "lottery winner," "inheritance claim," "next of kin," "gift card"
Phishing Urgency
"Account locked," "scheduled for deletion," "storage full," "verify your email," "subscription expired"
Brand & Government Impersonation
The brand you trust, the sender you shouldn't.
Scammers know you trust certain companies and government agencies. So they write emails that mention DocuSign, PayPal, Microsoft, the IRS, or your state DMV — complete with logos and official-sounding language. But the actual sender has nothing to do with that organization.
You get an email saying "Your DocuSign document is ready for signature." It looks real. The formatting matches what you've seen before. But the sender address is notifications@secure-doc-center.com, not docusign.com. You click, enter your credentials, and now they have access to your accounts — or worse, you wire money based on fraudulent instructions in the "document."
Or you receive a notice that your "driver's license renewal requires immediate action" from what looks like your state DMV. The sender? A random domain with no .gov address in sight.
When an email mentions a known brand or government agency, we check if the sender domain actually belongs to that organization. DocuSign only sends from @docusign.com and @docusign.net. PayPal only sends from @paypal.com. The IRS only sends from @irs.gov. Your state DMV only sends from .gov addresses.
If the email talks about one organization but comes from somewhere else, you'll see a warning.
Shopping & Retail
Amazon, Walmart, Target, Costco, Best Buy, Home Depot, Lowe's, eBay
Financial Services
PayPal, Zelle, Venmo, Cash App, Visa, Mastercard, Chase, Bank of America, Wells Fargo, Citibank, Capital One, American Express, Robinhood, Fidelity, Charles Schwab, TD Ameritrade
Tech & Productivity
Microsoft, Google, Apple, Yahoo, Zoom, QuickBooks, DocuSign, Adobe Sign, Dropbox, LinkedIn
Telecom
AT&T, Verizon, T-Mobile, Comcast/Xfinity, Spectrum, Cox, CenturyLink, Cricket, Boost Mobile, Metro by T-Mobile, Vodafone, O2, EE, BT, Three
Social Media
Facebook, Instagram, WhatsApp, TikTok, Snapchat, X/Twitter, Pinterest, Telegram, Discord, Reddit, Threads, Signal
Streaming & Entertainment
Netflix, Spotify, Disney+, Hulu, HBO Max, YouTube, Apple TV+, Peacock, Paramount+, Audible, Tidal, SiriusXM
Gaming
Steam, Epic Games, PlayStation, Xbox, Nintendo, Roblox, EA, Activision Blizzard, Riot Games, Ubisoft, Valve, Twitch
Shipping & Logistics
DHL, FedEx, UPS, USPS, Royal Mail
Insurance
State Farm, GEICO, Progressive, Allstate, USAA, Liberty Mutual, Farmers, Nationwide, UnitedHealthcare, Anthem, Aetna, Cigna, Blue Cross Blue Shield, Humana, MetLife, Prudential, New York Life, Northwestern Mutual
Travel & Airlines
Airbnb, Booking.com, Expedia, Southwest, Delta, United, American Airlines, JetBlue, Marriott, Hilton
Security Software
Norton, McAfee, Avast, AVG, Kaspersky, Bitdefender, Malwarebytes
Crypto
Coinbase, Binance, Kraken, Crypto.com, Gemini
Government Agencies
IRS, Social Security Administration, DMV (all 50 states), Medicare, state tax agencies, and other .gov entities
Auto & Memberships
AAA, Costco Membership, Sam's Club
Authentication Failures
The email says it's from them. The internet says it's not.
Every legitimate email server publishes authentication records — SPF, DKIM, and DMARC — that prove an email actually came from where it claims. When a scammer forges a sender address, these checks fail. Most people never see these results because they're buried in technical headers.
A criminal sends an email that says it's from your bank. The display name looks right, the email address looks right, but the email was actually sent from a completely different server. The bank's authentication records say "we didn't send this" — but that information is hidden in the headers where nobody looks.
We check SPF, DKIM, and DMARC authentication results in every email's headers. If any of these checks fail, it means the email wasn't sent from an authorized server for that domain. We surface this invisible information as a clear warning so you don't have to dig through technical headers yourself.
Deceptive Domains
Familiar names, hidden geography.
Criminals register domains that look like trusted .com addresses by using country-code extensions that include ".com" in them. At a glance, paypal.com.br looks like it might be related to paypal.com. It's not — it's a completely separate domain that anyone can register.
They also use commercial domains designed to look like real country codes. Extensions like .uk.com, .us.com, and .de.com aren't official government domains — they're sold by private registrars to anyone willing to pay.
These are commercial domains sold by private registrars. They have nothing to do with the countries they reference. Anyone in the world can register one.
Suspicious Domains
The domains scammers love.
Some domain extensions are heavily exploited by criminals because they're free to register, require no identity verification, or cost so little that scammers can register thousands at once and burn them after a single phishing campaign.
These domains aren't inherently malicious, but when one is asking you to click a link, verify your account, or send money, it deserves extra scrutiny.
Gibberish Domains
Real companies don't email from keyboard smashes.
Scammers burn through domains fast. They register a random string, blast out thousands of phishing emails, and abandon it before anyone catches on. No real business operates from xk7rm9.com or ndsm4.fr.
We analyze domain names for patterns that don't appear in legitimate business domains: no vowels, high ratios of numbers to letters, and chains of random-looking subdomains stacked together. Legitimate short abbreviations like msn.com and bbc.co.uk are excluded.
Gibberish Usernames
The domain looks fine. The username doesn't.
Sometimes the domain passes every check — it's a real company or a common email provider. But the username before the @ is a random mess of letters and numbers. Real people don't email you from xr7829@gmail.com. Scammers do, because they create throwaway accounts in bulk.
We analyze the username portion of the sender's email for patterns that don't look like real names or words. High ratios of consonants to vowels, excessive numbers mixed with letters, and strings with no recognizable structure all trigger detection.
Disposable Email Addresses
Built to use once and throw away.
Disposable email services let anyone create a temporary inbox in seconds with no registration, no verification, and no trail. Scammers use these throwaway addresses to send phishing emails, collect responses, and disappear before anyone can trace them.
We maintain a database of known disposable email providers. When an email arrives from one of these services, we flag it. Legitimate businesses and real people don't send emails from addresses designed to self-destruct.
Suspicious Routing
The hidden path your email took.
Sometimes an email shows one sender address but actually traveled through completely different servers. Email programs show this as "via" — like "john@company.com via sketchy-server.net." This can be legitimate, but it can also indicate spoofing.
We maintain a list of trusted email routing services. When an email is routed through a server NOT on our list — especially something random or suspicious — we flag it. Legitimate services like SendGrid, Mailchimp, Amazon SES, Google, and Microsoft won't trigger warnings.
International Sender
Context about where your email actually came from.
When an email arrives from a country-code domain, we tell you exactly which country. This isn't about blocking international email — it's about giving you context to make informed decisions.
If you're expecting wire instructions from your title company and the email comes from a foreign domain, that's critical information. Your bank shouldn't be emailing you from a different country. Your local escrow company doesn't operate overseas.
Instead of a generic warning, we identify the actual country of origin. You'll see exactly where the email came from, so you can decide if that makes sense for the context. We identify every country-code domain in the world — over 250 countries and territories.
Mass-Distributed Emails
Your bank doesn't CC 30 strangers on your account alert.
Legitimate invoices, payment confirmations, and account alerts are sent to one person — you. When an email about "your" account is blasted to dozens of recipients at once, that's a mass phishing campaign, not a personal notification.
We count the total recipients in the To and CC fields. When an email is sent to 10 or more people and contains content that should be personal — payment confirmations, account alerts, invoice notifications — we flag it. Real companies use BCC or marketing platforms. Scammers just dump addresses into the To field.
Document Lure Phishing
"Someone shared a document with you." No they didn't.
One of the most effective phishing tactics is sending an email that pretends to share a document through a trusted service like OneDrive, SharePoint, Google Drive, or Dropbox. The email looks exactly like a real sharing notification, but the link takes you to a fake login page that steals your credentials.
You receive an email saying "John Smith shared a document with you — View in OneDrive." The email looks identical to a real Microsoft notification. You click "View Document," enter your Microsoft credentials on what looks like a real login page, and now the attacker has full access to your email, files, and everything connected to your account.
We detect 18 common document-sharing phrases that scammers use to mimic real file-sharing services. When an email contains language like "shared a document with you," "view in OneDrive," or "click to access document" but the sender isn't from the legitimate platform, we flag it.
Pressure & Manipulation Language
They don't want you to think. They want you to obey.
Beyond obvious urgency phrases, sophisticated scammers use subtle psychological pressure. They tell you not to verify information through normal channels, use executive authority language to bypass your judgment, and create artificial time pressure around financial deadlines.
Some of the most dangerous phrases in a scam email tell you NOT to verify. "Don't call to verify — I'm in a meeting." "Do not contact your bank." "Please don't discuss this with anyone yet." When a real person needs you to act, they welcome verification. When a scammer does, they actively discourage it.
We detect 23 anti-verification phrases. If an email tries to stop you from verifying, that's one of the strongest signals that something is wrong.
Business Email Compromise (BEC) attacks mimic the way executives talk. "Handle this personally," "keep this between us," "I need this done before end of day," "I'm authorizing this directly." We detect 17 BEC-specific phrases that impersonate executive authority.
For real estate and financial transactions, scammers create fake urgency around closings. "Closing moved up to today," "wire must arrive today," "funding deadline moved up." We detect 20 closing-specific pressure phrases while carefully excluding routine business language that would cause false alarms.
Beyond Individual Signals
Individual checks catch obvious threats. Our smart detection connects the dots to catch the sophisticated ones.
Smart Attack Pattern Detection
A spoofed sender alone might be a misconfigured email server. A wire fraud keyword alone might be a legitimate closing email. But a spoofed sender + wire fraud keywords + pressure language + anti-verification phrases? That's a coordinated attack.
Our pattern engine analyzes every email across all 17 signal categories simultaneously. When multiple signals fire together in combinations that match known attack patterns, we identify the specific type of attack — not just "this looks suspicious" but "this is a payment redirect attack using a spoofed identity and pressure tactics."
Credential Harvesting
Fake login pages disguised as password resets or account verifications. Detected when urgency language combines with suspicious links from unknown senders.
Brand Phishing with Malicious Links
Emails impersonating known brands that link to fake websites on free hosting platforms. Caught when brand mentions don't match sender domains and links point to suspicious hosting.
Attachment-Based Attacks
HTML attachments that open fake login pages, and password-protected files designed to bypass email scanners. Flagged when attachment types combine with urgency and unknown senders.
Payment Redirect / BEC
The most dangerous pattern. Combines spoofed identity, wire fraud language, executive pressure, and anti-verification tactics. Designed to redirect payments to criminal accounts.
Each pattern requires multiple independent signals to fire before triggering a warning. Fewer false alarms on legitimate emails, stronger detection of complex, multi-layered attacks.
Provider-Flagged Email Surfacing
Gmail and Outlook already run their own security checks on incoming email. When they flag something suspicious, they display small, easy-to-miss banners that most people scroll right past.
We surface these provider warnings prominently alongside our own analysis. If Microsoft or Google thinks an email is suspicious AND our detection agrees, you'll see both assessments front and center. Two independent security systems reaching the same conclusion is a very strong signal.
Post-Compromise Recovery Guidance
If our detection identifies a high-confidence attack — especially a BEC or payment redirect attempt — we don't just warn you. We tell you what to do next. Immediate steps to take if you've already interacted with the email, who to contact, and how to limit the damage.
Because the worst time to figure out your response plan is when you're in the middle of an attack.