This is a bit left field from what I usually write about, but I’m in the business of helping people, and this is (extremely) helpful.
A client called in a panic after receiving an email the night before, saying her website would be shut down. I checked the email and immediately realised it was spam. She was relieved, of course, but had already engaged with it and become unnecessarily stressed. Thankfully, she contacted me before taking it further.
I explained how I identified the email as spam in a few seconds.
Check the sender’s email address
Specifically, the domain or the part that appears after the @ symbol, not before.
The email my client received came from a Gmail address (@gmail.com), but the request was related to her Shopify website. That’s a red flag. If Shopify, or any other large firm, contacts you, their email will closely match their website’s domain, for example, help@support.shopify.com or help@shopify.com.
The part before the @ doesn’t matter. It’s the part after the @ that counts.
Why this method works
There’s a one-way relationship between email addresses and website addresses (domain names):
- You can’t create an @phancybox.com email unless you own the phancybox.com domain.
- But owning the domain doesn’t mean you have to use matching emails; it just gives you the option.
- Anyone can create phancybox@gmail.com (but that doesn’t mean all Gmail emails are spam – more on this below)
So how do you know which option the business has taken?
Steps to take to confirm if the email is legit
Check the company’s website to see what method they’re using.
- Go to the website of the company that’s emailing you
- Look for an email address (try the footer or Contact page)
- What appears after the @ symbol in that email address?
- It should match what appears after the @ symbol in the email you received **
For example
- On the Phancybox website, our footer has Email Us. If you hover over that, you’ll see the email is something@phancybox.com
- So if you get an email claiming to be from us, it should also end in @phancybox.com
** Of course, there’s a type of exception. Some firms will tack on an extra word after the @ symbol, like @support.phancybox.com, that’s still legit. It still belongs to the main domain, phancybox.com.
So no, not all Gmail emails are spam
Now, this isn’t to say that all @gmail.com addresses are spam! Gmail addresses are free, and anybody can create one, so it’s an obvious choice for scammers, but plenty of legitimate businesses use Gmail. If you’re unsure, use the steps above to identify if the company is using their domain name, or Google’s, for example, and compare that to the email you received. The same logic is true for all other email providers, like Yahoo and iCloud. It doesn’t matter who the provider is, only only matters that the information advertised on the website matches the sender in your inbox.
If you’re still unsure, just ask
If it doesn’t match who they say they are, or looks off in any way, be suspicious. Don’t click, don’t reply, and definitely don’t pay. Ask ChatGPT, use the website’s chat or phone the company directly to ask if the email you received is safe.