Email fraud can hide in the sender, the domain, the links, the routing, the authentication, or the request itself. EFA checks for these warning signs when you open an email and tells you what it found before you decide what to do.
This email offers you a document or an account notice, but the links go to a website that has nothing to do with the sender. The page it opens is built to look like a real sign-in screen so you will type your password into it.
The email presents itself as a company you recognize, but it was not sent from that company and its links point to a free hosting or file-sharing site rather than the company's own website. That combination is a common way to collect passwords.
This email has a web-page file attached. Opening it launches a page in your browser that is stored on your own computer, which is a way to show you a convincing fake sign-in screen without a suspicious web address to notice.
The email includes a password-protected attachment and gives you the password to open it. Locking a file this way stops security software from checking what is inside, so it is sometimes used to slip a harmful file past scanning.
This can be legitimate — some firms genuinely send encrypted documents. Confirming first costs very little.
This email asks you to change payment or banking details, the sender's identity doesn't hold up, and the message discourages you from calling to check. Discouraging a phone call is the part that matters: it is there to stop you from discovering the change is fake.
The message is written to feel like it comes from someone you already know or an organization you already deal with, and it leans on that familiarity instead of proving who it is. Sounding familiar is easy to fake and is often the whole of the approach.
This email says you have a voicemail or a missed call waiting. The notice creates a reason to click quickly, and the link or attachment usually leads to a fake sign-in page or a harmful file dressed up as an audio recording.
This email tells you to copy something and paste it into your computer's Run box, terminal, or browser address bar, usually framed as a quick fix. No legitimate email ever asks for this. Following the steps runs the sender's instructions on your machine.
This email asks you to complete a browser check or a CAPTCHA to continue. Real websites don't email you to verify your browser. These fake verification pages exist to deliver harmful software or capture a password.
This email pairs a phone number with billing or charge language, often with an attached invoice. The aim is to get you to call. On the phone, a person will try to collect payment details or talk you into installing software that gives them access to your computer.
This email carries closing or cash-to-close wiring instructions. Property closings are the most targeted moment in email fraud, because the amounts are large, the timing is known, and a redirected wire is very hard to recover.
This email attaches a document and asks you to sign it and send it back by email or fax. Real e-signature services almost always keep signing inside their own system, so an attachment with return-by-email instructions is unusual.
This email says a secure or protected document is waiting and that you need to sign in to read it. That wrapper is convincing because real services do send messages like it, and it gives a reason to ask for your password.
EFA matched more than one known scam pattern in the same email. Any one of them alone might be explainable; several appearing together is much harder to explain innocently, so the warning names the group rather than a single pattern.
The sender has set your own name as their display name, so the email appears in your inbox looking as though it came from you. This is done to make a message feel internal and trustworthy, and it is sometimes used to claim your account was hacked.
The name shown in your inbox says one thing, but the actual email address behind it belongs to someone else. Most email apps show only the name until you look closer, which is what makes this worth pointing out.
The sender is presenting themselves as your own company or organization, but the message came from outside it. Mail that appears to come from your own IT team, HR, or leadership is a common way to ask for a password without raising suspicion.
This email mentions your organization by name but was sent from a domain that isn't yours. That is often perfectly ordinary — vendors, clients, and applicants all mention the companies they write to.
This email speaks in the voice of a company you recognize, but it wasn't sent from an address that company is known to use. Well-known brands are impersonated constantly because their name alone earns a moment of trust.
When the brand is named in the message body rather than the sender details, this appears as Brand Impersonation Suspected (Body). This can be legitimate when a company sends mail through a marketing or support service on its own behalf.
The email claims to come from a named organization — such as a bank, agency, or service provider — but the sending address doesn't belong to that organization. Agencies and institutions are impersonated because the name carries authority.
The sender's display name is built to influence how you read the message — for example, a name padded with an official-sounding title, a department, or a warning word — rather than simply naming a person or company.
EFA could not reliably identify who sent this message, so its sender-based checks could not run. This is a statement about what EFA was able to read, not an accusation about the email — but it does mean you have less protection than usual on this message.
This looks like a verification or security notice, but it refers to an account that isn't yours. Genuine security emails reference your own account. Someone may have entered your address on another service, or the message may be a phishing attempt.
This sender's address is almost identical to one already in your contacts, but not quite — often a single letter added, removed, or swapped. It is designed to survive a quick glance, which is exactly why it is one of the most effective tricks in email fraud.
The part of the address after the @ closely resembles a domain you deal with, but isn't it. An extra letter, a missing one, or a slightly different ending is enough to own a convincing address that has nothing to do with the real company.
This email contains characters that look exactly like ordinary letters but are drawn from another alphabet. Used inside a name, a web address, or payment details, they make something false read as completely normal — no amount of careful looking will catch it.
Depending on the message and your email app, this same check appears as STOP! DISGUISED LETTERS DETECTED. The meaning and the advice are the same.
The ending of the sender's web address — the part after the last dot — is not a real domain extension that exists on the internet. An address like this cannot belong to a genuine organization.
Something about the sender's domain follows a pattern more common in fraudulent mail than in ordinary business mail — its structure, its wording, or how it is put together.
This message came from a throwaway email service — the kind that hands out a temporary inbox with no identity check. These addresses are used when someone wants to send mail that can't be traced back to them.
The sender's domain looks machine-generated rather than chosen — a string of characters with no recognizable name behind it. Fraud campaigns register domains like this in bulk because each one is used briefly and then abandoned.
The part of the address before the @ appears randomly generated rather than being a name, a role, or a recognizable word. Real people and businesses normally use addresses a human would choose.
Some legitimate automated systems do send from machine-generated addresses, so weigh this alongside what the message actually asks for.
This message was sent through a free web-hosting or site-building service rather than from a company's own mail system. Established businesses generally send from their own domain.
The sender's web address was registered very recently. That is a fact about the address, not a verdict about the email — new businesses register new domains every day — but fraud campaigns rely on fresh domains because older ones get blocked.
The sender's address ends in a country code. On its own this means very little — plenty of legitimate mail crosses borders, and a few of these endings are used worldwide by ordinary businesses regardless of country. What makes them worth flagging is that they are also chosen to build addresses that resemble a familiar one.
This email uses wording that appears repeatedly in wire and payment fraud — the language of transfers, account details, and urgent financial instructions. The wording alone doesn't make a message fraudulent, but it marks the kind of request worth confirming.
Banks, accountants, and title companies discuss these topics legitimately every day. Confirming costs a minute; a redirected payment is very hard to recover.
This email asks you to change payment or wire instructions. This single request is the most common method in wire fraud, and it works even when the sender's address looks entirely legitimate, because accounts can be compromised.
This message contains payment or banking details. This notice is a routine reminder rather than a sign of anything wrong — it appears because money is involved and this is the moment when confirming is cheapest.
This email asks for the contact details of other people involved in an upcoming closing. Gathering who's who is how a criminal learns enough to impersonate the right person later and redirect a wire at the moment funds move.
On lower-risk messages this appears as Contact Request in a Closing Context, because the same request is often routine coordination. The check is the same either way.
Someone you haven't corresponded with before has sent a financial document to a mailbox that handles payments. First contact plus an invoice or banking document is the shape vendor impersonation usually takes.
Depending on the message, this may appear as Vendor Impersonation Risk — First-Time Sender to Financial Mailbox or First-Time Sender — Document to Financial Mailbox.
The subject line pairs a phone number with a charge amount — the signature of tech support billing scams. The message is built to alarm you about a payment you don't recognize so that you call the number instead of checking your account.
This email contains a QR code that leads somewhere suspicious. Codes are used instead of links because you can't read a destination before you scan it, and scanning usually moves you to your phone, where a fake page is harder to spot.
This email asks you to approve a sign-in or enter a verification code. Genuine sign-in codes appear on the device you are signing in from — they are not sent to you to enter on someone else's request. Approving one can hand over access to your account without your password ever being taken.
This email is built like a document-sharing or e-signature notice: a branded header, a document icon, one large button, and very little text. That layout is copied closely because it gets people to click the button without reading.
This email has an attachment of a type that can carry a program inside it, even though it looks like an ordinary picture file. Most image files are perfectly safe; this particular kind is the exception, and scammers use it to send people to fake websites.
Almost everything in this email is a picture rather than text. Putting the message inside an image hides its wording from security tools that read text, while still showing you something that looks completely normal.
Marketing newsletters are sometimes built this way too, so weigh it against what the message is asking you to do.
This email arrived with no subject line. Business correspondence almost always has one, and blank subjects are common in bulk phishing that was sent from a template.
The wording of this email uses pressure of the kind found in phishing — deadlines, threats of suspension, or warnings that something bad happens if you don't act immediately. The purpose of that pressure is to get you moving before you check.
Genuine notices can sound urgent too. The test is whether you can confirm it somewhere other than the message itself.
The address your reply would go to is different from the address that sent the message. That can be entirely legitimate, but it is also how a scammer quietly moves your response — and anything you put in it — to an inbox they control.
On some messages this appears as Suspicious Reply Destination. Shared mailboxes, support desks, and mailing services legitimately do this.
This email was sent by one domain on behalf of a different one. Plenty of legitimate services do this — payroll, scheduling, and marketing platforms all send for their customers — but it can also disguise where a message really came from.
On its way to you, this email passed through a relay server with a randomly generated name. Established businesses send through recognizable mail systems, so an anonymous hop in the path is unusual.
In Gmail this appears as Suspicious Third-Party Routing.
Your email provider marked this message as suspicious before EFA looked at it, and EFA is passing that on so it isn't missed. Two independent systems raising a concern about the same message is worth noticing.
This message went to a large group of recipients. Newsletters and announcements do that routinely — but genuine invoices, payment confirmations, and account alerts are sent to one person, so seeing one of those in a mass send is odd.
You weren't addressed directly — your copy arrived as a blind carbon copy. This is normal for mass emails and newsletters, and it can also be used to hide who else received the message.
Protection may vary by email platform as EFA continues to expand capabilities across supported services.