How can you tell if an email is a scam?
You tell a likely scam by comparing what the message claims with what the mail system actually shows: the From address, the domains behind links, and whether it asks you to act through its own buttons. None of that proves safety. Never tap the email’s own links or attachments to “verify”. Open the real site yourself, or ignore the message.
What should you compare first: the name or the address?
The display name is decoration. Anyone can set it to a bank, a courier, a colleague, or a government office. The part that matters is the mailbox after it: the local part, the @, and the domain. Read the full address in the raw headers or the expanded From field, not the friendly line at the top of the thread.
If the name says a person you know and the domain is a free webmail host you have never used with them, treat the message as untrusted. If it claims a company, the domain should match the organisation’s real site character for character. A clean match still is not proof of identity; it only means this particular lie is not obvious. A simpler habit than any tool is to stop and type the organisation’s address yourself.
How do look-alike addresses and mismatched links work?
Look-alikes swap letters that look similar, add a hyphen, or use a different country ending. They hope you glance, not read. Hover or long-press a link and read the destination before anything loads. If the visible text names one site and the true host is another, do not follow it. Copying the link into a notes app still counts as using the email’s own address; type the real site in a fresh tab instead.
Attachments and “secure document” buttons are the same class of risk: they ask you to leave the inbox on the sender’s terms. A paper letter or a phone number you already have on a statement is slower and often the better choice. GROX can draft a reply or summarise a thread you paste, but it cannot certify that an inbound address is genuine.
| Check | What you look at | What a pass still leaves open |
|---|---|---|
| Display name versus From | Full mailbox, not the friendly label | Stolen or look-alike domains can still match a name |
| Domain spelling | Hyphens, extra letters, odd endings | A correctly spelled domain can still be abused |
| Link preview | Host shown on hover or long-press versus the words on the button | Shorteners and redirects hide the next hop |
| Ask and urgency | Passwords, codes, payment, secrecy, a deadline | A calm, well-written ask can still be fraud |
What does the wording usually try to make you do?
Scam mail is built around an action: confirm a login, pay a fee, open a file, move money, or stay quiet. Urgency, secrecy, and fear of a frozen account are levers, not evidence. Legitimate firms do not need you to use a link they sent in order for you to reach their real site.
Ask what would happen if you did nothing until you used a channel you already trust. If the answer is “the world ends this afternoon”, that is a reason to slow down, not speed up. A shared inbox rule or a paper checklist on the desk beats a clever filter you never read.
- Claimed identity
- The person or brand the body pretends to be. Treat it as a story until the address and an independent channel agree.
- Transport identity
- The From domain and, if you can see them, Received lines. Still forgeable in part; still worth reading.
- Call to action
- The click, code, payment, or silence the mail wants. Judge the ask, not the logo.
- Independent check
- A number, URL, or office you already had, not one supplied in the same message.
When is a simpler tool than an assistant the better choice?
If the only task is “do not click”, you do not need software. Mark as junk, delete, and visit the real site from a bookmark. Assistants help when you already decided the mail is untrusted and you want a plain rewrite, a list of claims, or a draft to a real help desk you found yourself.
GROX is a single conversational surface that can send mail through connectors you attach; that does not make inbound mail safe. For a one-off scare, the phone number on a card in your wallet is the simpler tool. For a household, a written rule — never use links in unexpected mail — beats any product page.
Common questions
Is a matching From address enough to trust an email?
No. A matching display name and even a familiar-looking domain only means one cheap lie is missing. Accounts get stolen, look-alikes slip past a glance, and forwarding can confuse the trail. Use a channel you already had. Never prove identity by following the message’s own link or attachment.
Should I click a link to see where it goes?
No. Hover or long-press if your client shows the host without loading it. Opening the link, even “just to check”, is acting on the sender’s terms. Type the organisation’s real address in a new tab from memory, a bookmark, or a paper statement. If you cannot recall the real site, wait rather than use the mail.
What if the email asks for a code, password, or payment?
Treat that ask as a reason to stop. Real firms do not need a code from an unexpected message to keep your account. Call or visit using details you already possess. Do not reply with secrets, and do not use “verify” buttons in the same thread. A delay costs less than a rushed transfer.
Can an AI assistant confirm that a message is genuine?
It can help you list claims, compare the visible name with the address you paste, and draft a note to a help desk you found yourself. It cannot see the true sender on the wire or prove a domain is honest. A clean checklist is not proof. When in doubt, ignore the mail and use an independent channel.
For how GROX routes chat, mail connectors and memory, see the home page and Help Centre.