Is This Email Genuine?

Yes. Nothing you paste leaves your computer. The checker is a small piece of code that runs inside your own web browser, on your own machine — there is no upload, no server receiving anything, and nothing stored or logged at our end. If you want to prove it to yourself, disconnect from the internet once the page has loaded and the checker will still work perfectly. Headers do contain your email address and details of the servers involved, which is precisely why we built it this way.

Parts of them, yes — and that is exactly what the checks are for. Anyone can type whatever they like in the From line. It is no more reliable than the return address written on the back of an envelope. What is far harder to fake is the record each mail server adds as the message passes through, and the pass-or-fail verdicts your own mail provider stamps on it the moment it arrives. Those get added after the sender has lost control of the message. A forger can write a convincing From line, but they cannot make somebody else's server vouch for them.

No, and this is the most important thing on the page. A pass means the message genuinely came from the domain printed on it. It tells you nothing about who was sitting at the keyboard. If a supplier's or a colleague's real account has been broken into, every email the criminal sends from it will pass every check here — because it really is their account. That is how most invoice and payment fraud against small businesses actually works. Treat a pass as one piece of evidence, not as permission. Anything involving bank details, a payment or a password still gets confirmed by phone, on a number you already had.

It means those checks were not in the text you pasted, almost always because only part of the record was copied. The verdicts are added by your own mail provider and sit near the top of the record, so if you started copying partway down, they are missing. Go back and copy the whole block, starting from the very first line. You will also see it on internal email that never left your own systems, which is normal and not a cause for concern.

Yes. The delivery record is part of how email itself works, so every provider produces one and the checker reads them all the same way. The only thing that differs is where you click to find it, and the panel further up this page covers Outlook, Gmail and Apple Mail. One thing matters more than which provider you use: check the original email, not a forwarded copy. Forwarding rewrites the record, so you would be checking your own message rather than theirs.

Stop and confirm before you do anything else. If the email asked you to pay something, change bank details or log in somewhere, do not do it — and do not use any phone number or link taken from the email itself. Ring the organisation on a number you already had. If someone has already clicked, entered a password or made a payment, change that password immediately from a different device and tell your bank straight away. Then send it to me and I will look at it myself, at no charge. A live attempt on a business is rarely aimed at one person, so the rest of your team need to know today.

Yes, and it takes seconds. Forward suspicious emails to [email protected], the National Cyber Security Centre's reporting service. Scam text messages go to 7726, free from any UK mobile. If money has already gone or an account has been broken into, report it to Action Fraud on 0300 123 2040 or at reportfraud.police.uk, which covers England, Wales and Northern Ireland — in Scotland, report to Police Scotland on 101. It is worth doing: reporting is how fake websites get taken down before they catch somebody else.