"Dear customer, your parcel is being held at our depot because the delivery address is incomplete. If the $1.99 redelivery fee is not paid within 24 hours, your parcel will be returned to the sender. Click here to update your address."
You've probably seen some version of this message yourself. Sometimes it comes as a text, sometimes as an email; the logo looks right, the wording is clean and the amount is tiny. The small amount is exactly the trick, because nobody thinks twice about a couple of dollars. But the card details typed into that page get used for a lot more than $1.99.
Phishing is a scam in which someone poses as a trusted organisation to get your password, card details or a verification code. Below we go through, one by one, the places to look when you want to know whether an email is fake. At the end there's a checklist, and advice on what to do if something like this lands in your temporary inbox.
The most common phishing scenarios
Scammers aren't creative, they're consistent. They use the same handful of stories again and again, because they work. These are the ones that turn up most often:
- Parcel on hold. The example above. Subject lines like "incomplete address", "customs fee due" or "delivery failed". If you're actually waiting for an order, it becomes far more convincing.
- Bank security alert. "Suspicious activity has been detected on your account and your card will be blocked." The link takes you to a pixel-perfect copy of your bank's login page.
- Tax refunds and government notices. "A refund has been issued in your name", "You have an unpaid traffic fine". They borrow the look of an official body to cause panic or excitement.
- Account suspended. Streaming services, social media, your email provider. "Your payment method was declined and your account will be closed."
- Prize draws and gifts. "Congratulations, you've won. Just pay the shipping to claim your prize."
- Fake invoice or order. "Your order for $549.99 has been confirmed. If this wasn't you, click here to cancel." The trap is the rush to cancel.
How do you check the sender's address?
The name you see in your inbox, the "display name", can be anything the sender wants. "Bank Customer Services" proves nothing. What you need to look at is the actual address next to the name, or the one that appears when you click on it.
Things to watch for:
- Is the domain after the @ sign really the organisation's domain? Look for swapped characters, like "1" instead of "l", "0" instead of "o", a hyphen slipped in.
- Does the organisation's name appear at the start of the domain, with something else at the end? An address like "companyname.security-notice.xyz" doesn't belong to that company. It's the last part that counts.
- An "official" notice sent from a free email service is almost always fake.
It's also worth knowing that the sender address can be technically spoofed. So even if the address looks right, check the other signs when the content seems off. One check on its own isn't enough.
Why is urgent language a warning sign?
In almost every phishing email you can hear a clock ticking, with phrases like "within 24 hours", "final warning", "if you don't act now". The reason is simple. People in a hurry don't check. A real bank might warn you too, but it will usually point you to its app or official channels, not to a link inside the email.
A good rule of thumb is that the more an email rushes you, the slower you should move.
Where does the link go? How can I tell without clicking?
On a computer, hover your mouse over the link without clicking. The real destination appears in the bottom-left corner of your browser or email program. A button saying "Log in" doesn't change where it actually leads.
- Rest your cursor on the link or button.
- Read the domain part of the address that appears. Starting with "https://" doesn't make a site safe on its own; fake sites can get certificates too.
- Shortened links (short addresses made of a few characters) hide the destination. Be suspicious if an official organisation sends you one.
- On a phone, long-press the link; most devices show the address before opening it.
- If in doubt, don't use the link at all. Type the organisation's website into the address bar yourself, or open its app.
Stop before you open an attachment
"Invoice.pdf.exe", "Delivery_Details.zip", an Office document asking you to enable macros. If you weren't expecting an attachment, and especially if it's a compressed file or a document that tells you to "enable content", don't open it. If an organisation really sent you an invoice, you can usually find it by logging in to its website directly.
Phishing email checklist
When an email looks suspicious, run it past this table. If you answer "yes" on more than one row, it's very likely fake.
| Check | Red flag | What to do |
|---|---|---|
| Sender address | The domain doesn't exactly match the organisation's, or has character tricks | Look at the real address, not the display name |
| Greeting | Nameless, like "Dear customer" or "Valued user" | Not proof on its own, but stay alert |
| Urgency | Time pressure, fines, threats to close your account | Slow down and verify through official channels |
| Link | Hovering shows a different domain | Don't click; type the address yourself |
| Attachment | An unexpected zip, exe or macro-enabled document | Don't open it; delete it |
| Information requested | Password, card details, a text message verification code | No legitimate organisation asks for these by email |
| Small payment | A "redelivery" or "customs" fee of a dollar or two | Don't enter your card details on that page |
What should I do if a suspicious email lands in my temporary inbox?
After you've used a temporary address on a site, phishing emails can start arriving at it. That usually means the address has ended up on a list. The good news is that the address isn't tied to your real identity, and it will be out of use within a few hours anyway.
On Geçici Mail, incoming HTML emails are displayed safely. Scripts inside them are stripped out, and the message opens in a separate frame, isolated from the rest of the page. Attachments aren't shown at all. So simply reading the email doesn't put you at risk.
There is one limit, though. If you click a link inside the email, your browser takes you to that outside site. What happens from there is out of our hands. If you type your password into a fake bank page, the fact that the address was temporary changes nothing; what gets stolen is your password.
So:
- Don't click links or fill in forms in suspicious emails.
- Read the email and close it; if you like, use the DELETE button to drop the address and get a new one.
- If it looks like a warning about one of your real accounts, check by opening the organisation's app or website yourself.
We cover the security side of temporary addresses in is a disposable email address safe, and dealing with unwanted mail in how to stop spam emails.
I clicked and entered my details. What now?
Don't panic, but move quickly. If you entered a password, change it for that account right away, along with any other accounts where you use the same password. If you entered card details, call your bank on its official customer service number and have the card blocked. If two-step verification isn't switched on, turn it on. The sooner you act, the more the damage stays contained.
FAQ
Can a phishing email harm me just by opening it?
In modern email programs, reading an email usually isn't harmful on its own. The real risk is clicking a link and entering information, or opening an attachment.
How can I tell if a link is fake without clicking it?
On a computer, hover your cursor over the link; on a phone, long-press it. If the domain shown doesn't exactly match the organisation's real domain, don't click.
Do banks ask for passwords or text message codes by email?
No. Banks and official bodies don't ask for your password, card details or the verification codes sent to you by email. A request like that is a sign of phishing.
Is it safe to click a link in an email sent to my temporary address?
Geçici Mail strips scripts from HTML emails and shows them in an isolated frame, but clicking a link takes you to an outside site. Don't click links in suspicious emails.