Free — no signup
Email Scam Checker
Paste an email address, or the full email including headers. GACS scores it against 1,700+ confirmed scams plus homograph, impersonation and phishing heuristics.
How the email checker works
The checker parses the sender address, normalizes the domain using the same IDN / punycode canonicalization we use for URL scam lookups, then queries the GACS blacklist database for any confirmed scam entity that matches the sender or any link found in the body. On top of that it runs deterministic phishing heuristics: brand impersonation from freemail accounts, Reply-To mismatch, urgency language, credential and payment requests, and insecure http:// links.
What to paste
- The sender address on its own (e.g.
alerts@paypa1-secure.com). - Or the full email — copy the "Show original" / "View source" version from your mail client so we can see
From,Subject,Reply-To, and the body.
A real phishing email, line by line
This is the shape almost every credential-phishing email takes. Each numbered line is a giveaway you can check yourself in under a minute.
From: "PayPal Support" <alerts@paypa1-secure.com> (1) Reply-To: paypal-help@gmail.com (2) Subject: Your account has been suspended (3) Dear Customer, (4) We detected unusual activity on your account. You have 24 hours to verify your password or your account will be permanently closed. (5) Verify now: http://paypa1-secure.com/login (6)
- The display name lies. Anyone can type "PayPal Support". The domain after the @ is what counts —
paypa1-secure.comuses the digit 1 in place of the letter l. - Reply-To doesn't match. Replies go to a free Gmail account. No company collects replies on freemail.
- Account-suspension subject. Fear is the hook that stops you checking.
- No name. "Dear Customer" means the sender bought your address in a list and doesn't know who you are.
- A countdown. Real providers don't delete accounts in 24 hours over an unverified password.
- An http:// link to a look-alike domain. No legitimate login page is served without https, and the domain is the same fake from line 1.
Paste that whole block into the box above and the checker flags every one of those signals with a weight, so you can see which ones pushed the score up.
Related tools
- Scam URL / wallet / phone checker
- Social account scam scanner
- Who called me? Reported phone numbers
- Reverse image scam check for profile photos
- Report a scam email
Frequently asked questions
How do I check if an email is a scam?
Paste the full email — including the From, Subject, and Reply-To headers when you have them — into the checker above. GACS normalizes the sender domain, looks it up against 1,700+ confirmed scams, flags IDN/homograph spoofs, and scores urgency, credential requests, and brand impersonation heuristics.
What signals does the email checker use?
Sender-domain blacklist hits, look-alike domains (Cyrillic/Greek characters that mimic Latin letters), Reply-To mismatch, brand impersonation from freemail accounts, urgency and fear language, credential and payment requests, and http:// links used in place of https://.
Is the email checker free?
Yes. No signup, no card. GACS runs on donations and paid diplomas so the scam-checker tools stay free for anyone.
How can I tell if an email is really from my bank?
Look at the part of the sender address after the @ — it is the only part that can't be faked by the display name. A real bank writes from its own domain, never from Gmail, Outlook or a look-alike like chase-secure-alerts.com. If the message wants you to log in, open the bank's app or type the address yourself instead of clicking, and call the number printed on your card.
I clicked a link in a phishing email — what should I do now?
If you only opened the page and typed nothing, you're usually fine: close it and run a virus scan. If you entered a password, change it immediately — and anywhere else you reused it — then turn on two-factor authentication. If you entered card or banking details, call your bank now and ask them to freeze the card. Keep the email as evidence and report it.
Is it safe to open a scam email?
Opening the message is normally safe in a modern mail app. The danger is what comes next: clicking links, opening attachments, enabling content or macros in an attached document, or replying. Don't reply — it confirms your address is live and usually brings more scam mail.
Does GACS store the email I paste?
The text is sent to our server to be scored. It isn't saved to your account or published anywhere. If you want a scam email added to the public registry, submit it deliberately through the report form.
Authoritative sources
Independent primary sources used to check and corroborate the guidance on this page.
FBI Internet Crime Complaint Center (IC3)Official US channel for reporting internet-enabled fraud and cybercrime.
US Federal Trade Commission — ReportFraudConsumer fraud reporting and published enforcement data.
UK Report FraudUK national reporting centre for fraud and cybercrime.
Canadian Anti-Fraud CentreCanada's central repository for fraud reports and scam alerts.