What you see isn’t always what you get

Hidden details in emails that most people don’t know about

An email looks simple: a name at the top, a message, maybe a button to press. But some of the most important facts about an email are hidden from view. Scammers know this, and they count on you not knowing it. This article shows you what’s hidden, how to see it, and the few simple habits that keep you safe.

What’s hiding in this email?

An example of a fake bank email. The red text is what you can’t see on the screen. On a phone, spread two fingers on the picture to zoom in.

The name at the top isn’t proof of who sent it

When an email says it’s from “Chase Bank” or “Amazon Customer Service,” that name was simply typed in by whoever sent it. Anyone can type any name. The name is not evidence of anything.

Behind the name is the real email address it came from, and your email program usually hides it. To see it:

• Mail on an iPhone or iPad: tap the sender’s name at the top of the message.
• Gmail on a computer: the address appears beside or just under the sender’s name; if it doesn’t, click the small arrow next to “to me”.
• Gmail on a phone: tap the sender’s name.

Look at the part after the @ sign. A real bank writes from its own name, such as chase.com, not from something like chase-alerts-secure.com, or from a free Gmail or Yahoo address.

The words on a button aren’t where it goes

A button that says “Verify your account” or “Track my package” has a web address hidden underneath it. The words are chosen by the sender. The hidden address is where you actually land. They don’t have to match, and in a scam they won’t.

Even a link that looks like a web address, such as www.chase.com, can take you somewhere completely different. What a link shows and where it goes are two separate things. Scammers also dress up their addresses with a real company’s name at the front, like chase-alerts-secure.com.login-id.ru in the example above. What counts is the very end: .ru is a Russian address, nothing to do with Chase.

To see where a link really goes, without opening it:

• On a computer: rest the pointer on the link without clicking. In many email programs the real address appears in a small pop-up or at the bottom corner of the window. Or right-click it and choose Copy Link.
• On a phone or tablet: press and hold your finger on the link until a menu appears. Don’t tap it, because a tap opens it. The menu shows the address and offers Copy Link.

“Reply” may go somewhere else entirely

An email can quietly say: “when they reply, send it to a different address.” So a message that appears to be from your bank can send your answer straight to a scammer. Most real emails don’t do this. To check, press Reply, read the To line, then close it without sending. If it doesn’t match who the email claims to be from, treat the whole message as fake.

Logos and designs are easy to copy

A scam email can look exactly like the real thing: the right logo, colors and layout. Copying these takes a scammer seconds. How an email looks tells you nothing about who sent it.

Hidden isn’t the same as fake

Here’s the important part: legitimate companies hide these details too. Nearly every real email from your bank, a store or a delivery company uses buttons with the address hidden underneath, and shows a name rather than an address. So the hiding alone doesn’t prove an email is a scam.

What it does mean is that you can’t trust what you see on the surface. The name, the button and the logo can all be made up. That’s why the habits below matter more than trying to spot every trick.

Not sure about a message? Take a screenshot and run it through ScamCheck. It reads the whole message, warns you about links and buttons you shouldn’t tap, and tells you what to do next. Curious where a particular link really goes? URL-Check can show you.

If in doubt, don’t react to it. What you can see was chosen by the sender. What’s underneath is the fact.