How to Spot a Fake Verification or Password-Reset Email
"Your account has been locked." "Confirm your email within 24 hours or it will be deleted." "Unusual sign-in detected. Verify your identity."
Security-themed emails are among the most effective phishing lures, because they create urgency and imitate messages we're trained to act on quickly. This guide covers the warning signs of fake verification and password-reset emails, how to check a message without risk, and what to do if you've already clicked.
Why attackers imitate account emails
Real services send verification codes, password resets, and sign-in alerts all the time. You're used to them, you expect them to be urgent, and you usually click without thinking. Attackers exploit that habit in a few ways:
- Credential phishing: a link leads to a fake login page that captures your password.
- Code theft: a fake "support" message asks you to read back a code that was actually sent to take over your account.
- Malware delivery: an attachment disguised as a "security report" or "invoice" installs something harmful.
- Consent tricks: a link asks you to grant a malicious app access to your account (OAuth phishing), with no password needed.
The warning signs
No single sign is proof, but the more of these you see, the more careful you should be.
1. You didn't ask for it
The biggest red flag. A real verification code or password reset almost always follows something you did seconds earlier. An unexpected code can also mean someone else is trying to log in to your account. Don't share it with anyone, and consider changing your password.
2. The sender address doesn't match
Look at the actual address, not just the display name. "Security Team" can be sent from anything. Watch for:
- misspelled domains:
paypa1.com,micros0ft-support.com - extra words:
amazon-account-verify.com - free email providers used for "official" notices
- subdomains designed to confuse:
apple.com.security-check.net(the real domain issecurity-check.net)
3. The link goes somewhere else
On desktop, hover over a link to see the real destination. On mobile, long-press it. The domain right before the first single / is what matters. If the email claims to be from your bank but the link goes to an unfamiliar domain, don't click.
4. Pressure and threats
"Within 24 hours," "permanently deleted," "legal action," "final notice." Real companies rarely threaten to delete your account over an unverified email in a single day.
5. Requests a real company wouldn't make
Legitimate services will never ask you to:
- reply with your password
- read a verification code back to a "support agent"
- install remote-access software to "fix" your account
- pay a fee or buy gift cards to unlock an account
6. Odd formatting or tone
Generic greetings ("Dear Customer"), mismatched logos, strange spacing, or slightly off grammar used to be reliable clues. They're less reliable now that attackers use AI writing tools, so don't treat a polished email as proof it's real.
7. Unexpected attachments
Account emails rarely need attachments. Be especially wary of .html, .zip, .iso, or Office files that ask you to "enable content."
A safe routine for any account email
If you're not sure, you don't have to decide from the email alone:
- Don't click links or open attachments in the suspicious message.
- Open the service directly. Type the address yourself or use the official app or a bookmark.
- Check your account there. If there's a real problem, you'll see a notice after logging in.
- Look at recent security activity. Most major services list recent sign-ins and devices.
- Report the email using your mail provider's "Report phishing" option.
This works for every service and doesn't require you to become an expert at reading headers.
Checking the technical details (optional)
For a closer look, most mail apps let you "Show original" or "View source." Look for the authentication results:
- SPF checks whether the sending server is allowed to send for that domain.
- DKIM checks that the message wasn't altered and was signed by the domain.
- DMARC ties those together with the visible "From" domain.
pass for all three on the real company's domain is a good sign. A fail, or a pass on an unrelated lookalike domain, is not. Keep in mind that attackers can pass these checks for domains they own, so authentication confirms who sent a message, not whether the sender is trustworthy.
Where disposable email fits in
Using separate addresses for different purposes makes phishing easier to spot. If you only ever gave your bank your primary address, and you get a "bank" email at an address you used for a newsletter signup, you know immediately it's fake.
A temporary burner email inbox is useful for one-off signups that shouldn't reach your real address at all, and it expires on its own, so any phishing later sent to it goes nowhere. For accounts you keep, per-site aliases forwarding to your main inbox give you the same benefit.
Never use a temporary inbox for banking, healthcare, government, or any account you'll need to recover later.
If you've already clicked
Act quickly. It's usually fixable.
- If you entered a password, change it immediately on the real site, and anywhere else you reused it.
- Turn on two-factor authentication, preferably with an authenticator app or passkey rather than SMS.
- Sign out of all sessions from the account's security settings.
- Check for changes: recovery email, phone number, forwarding rules, and connected apps. Attackers often add a forwarding rule to keep receiving your mail.
- If you opened an attachment, run a full scan with your device's security software, and consider getting help if it's a work device.
- If financial details were involved, contact your bank directly using the number on your card.
- Report it to your email provider and, for work accounts, to your IT or security team.
Frequently asked questions
I got a verification code I didn't request. Should I worry? Someone may have typed your address by mistake, or someone may be trying to access your account. Don't share the code. If it keeps happening, change your password and enable two-factor authentication.
Can a phishing email come from a real company's address? Occasionally, if that company's systems are compromised, or through spoofing on domains without strict DMARC. That's why checking the account directly is safer than trusting the sender line.
Are text-message codes safer than email codes? Both can be phished. Authenticator apps and passkeys are more resistant, and passkeys in particular won't work on a fake site.
Is it safe to just open a phishing email? Opening it in a modern mail app is generally low-risk. Clicking links, downloading attachments, or replying is where the risk is.
Keep one-off signups away from your real inbox. Generate a free temporary address that deletes itself after 24 hours. Read about our approach in the Privacy Policy.