How to Check an Email Sender's Real Address
The name you see is not always who sent the email. How to reveal the real sender address and reply-to address in common email apps, and how to spot lookalike domains.
Email apps show you a sender's display name, such as "Microsoft Support" or "Your Bank", which anyone can type. The real address behind it tells you much more. Checking it takes two seconds and exposes a large share of phishing.
How to reveal the real address
- Phone apps: tap the sender's name at the top of the email to expand the full address.
- Web email: hover over or click the sender's name.
- Desktop apps: the address usually appears next to or when you hover over the name.
What to look for
| Display name | Real address | Verdict |
|---|---|---|
| Example Bank | alerts@examplebank.com | Plausible, if that is the bank's real domain |
| Example Bank | examplebank.alerts@freemail[.]com | Free email service: suspicious |
| Example Bank | alerts@examp1ebank[.]com | Lookalike domain. See lookalike domains |
| IT Helpdesk | helpdesk@yourcompany-support[.]net | Not your company's domain |
These are illustrative addresses.
Check the reply-to
When you hit reply, look at the address in the "To" field. If it differs from the sender, be cautious: the attacker may want your reply to go elsewhere.
Limits of this check
- Genuine accounts can be hacked and used to send phishing. See reply-chain phishing.
- Some spoofed emails show the exact real address. Email authentication helps block these. See SPF, DKIM and DMARC explained.
The address is one clue; the request is the decider. Unexpected requests to sign in, pay or share codes should be verified another way, whatever the address.
Unsure about a sender? Paste the email into CyberWatch AI Scan for a free check.
For more checks, see how to recognise phishing in our complete guide.
Frequently asked questions
Can the sender address be faked completely?
Display names are trivial to fake, and exact addresses can sometimes be spoofed if a domain lacks email authentication. Lookalike domains and compromised real accounts are also common.
What is a reply-to address?
The address your reply goes to. Phishing sometimes shows a genuine-looking sender but sets the reply-to to an attacker's address.
If the address is real, is the email safe?
Not necessarily. Real accounts get compromised. Still judge the request and verify unusual ones by another channel.
Sources
- How To Recognize and Avoid Phishing Scams, US Federal Trade Commission
- Avoid and report phishing emails, Gmail Help
- Suspicious email actions, UK National Cyber Security Centre
