How to Check an Outlook Email for Scams Before You Click or Pay

You can vet an Outlook email for scams in about a minute without installing anything: check the real sender address, inspect where links actually point, compare invoice and payment details against what you already know, and treat urgency plus a payment change as a stop signal. This works for Outlook Web and the desktop app, and it covers the most common attacks — phishing links, fake invoices, and business email compromise (BEC) payment-redirect requests. If you want an automated second opinion, a tool like AI Email Genie adds a one-click risk badge (Safe / Caution / High Risk) plus red flags and, on Pro, a plain-English explanation inside Outlook Web — but the manual checks below stand on their own.

Start with the sender, not the subject

The display name is free text; the address behind it is the evidence.

• Expand the sender. In Outlook Web, click the sender name to open the contact card and read the full SMTP address. In desktop Outlook, open the message and look at the From line, then right-click the address to view properties.
• Compare the domain character by character. Attackers rely on look-alikes: rnicrosoft.com for microsoft.com, paypa1.com for paypal.com, or a real brand name in the subdomain (microsoft.billing-secure.com). Read right to left — the domain immediately before the final .com/.net is what matters.
• Check the reply-to. A message that displays as your CFO but replies to a Gmail or random domain is a classic BEC setup. In Outlook, open the message, go to File → Properties (desktop) to see the Reply-To header.
• Weigh the Auth Score signal. If your provider or a checker shows SPF/DKIM/DMARC results, a failure means the sending server wasn't authorized for that domain. It's a strong warning sign, not proof on its own — legitimate senders occasionally misconfigure this.

Red flags in the sender field

Inspect links without clicking them

Never click to "see where it goes." Hover or copy instead.

1. Hover over the link (desktop) and read the URL in the status bar at the bottom. On mobile or web, long-press or right-click and choose Copy link address.
2. Read the destination domain right to left. https://outlook.com.login-verify.xyz is not Outlook — the real domain is login-verify.xyz.
3. Watch for mismatches. Link text says invoice.pdf but the URL points to an executable or a random domain.
4. Be wary of shortened links (bit.ly, t.co) and links wrapped in a redirect (...?url=). If you must check, paste the domain into a search engine rather than opening it.
5. Check for HTTPS carefully. A padlock only means the connection is encrypted — scam sites use HTTPS too. It says nothing about whether the site is honest.

Verify invoice and payment details against your own records

This is where fake-invoice and payment-fraud emails do their damage, so slow down here.

• Match the amount and invoice number to a purchase order, contract, or prior invoice you already have. Unexpected amounts or a first-time invoice number deserve a call.
• Confirm the bank details against a previously verified record — not against anything in the email. A "we've changed our bank account" note is one of the highest-risk signals in BEC.
• Check the payee name matches the legal entity you normally pay. Slight name variations are common in fraud.
• Open attachments cautiously. Invoices should be PDFs or images. A .zip, .html, macro-enabled Office file, or a link to a "portal" to view the invoice is a red flag. Preview attachments in Outlook rather than downloading and opening them.
• Use a short invoice checklist every time: sender verified → amount matches records → bank details match records → attachment type is expected → no urgency pressure. Any "no" means verify by phone before paying.

Read the tone and timing for pressure tactics

Social engineering works on urgency, so treat these as signals rather than instructions:

• A deadline measured in hours, threats of account closure, legal action, or lost service.
• A request to keep the matter confidential or to bypass normal approval steps.
• A payment or bank-change request arriving right before a weekend or holiday.
• A thread that suddenly changes tone, signature, or writing style mid-conversation — a sign of a hijacked mailbox.
• Grammar and formatting that don't match previous emails from that person, though polished scams exist, so don't rely on this alone.

What to do once you've confirmed it's suspicious

1. Don't reply, click, or pay. Replying confirms your address is live.
2. Verify out-of-band. Call the person or company using a number you already have — not one from the email. For a supplier, use the contact on their official site or your contract.
3. Report it. In Outlook, use Report → Phishing (or Junk) so your provider and security team can act. If it impersonates a colleague, tell them and your IT/security contact.
4. Delete it after reporting, and empty the deleted items if your policy requires it.
5. If you already clicked or paid, contact your bank immediately, change any credentials you entered, and report to IT. Speed matters more than embarrassment.

When to use an automated checker

Manual checks catch most scams but are easy to skip when you're busy. An in-inbox checker adds a consistent layer:

• What it does: AI Email Genie places a one-click "Assistant" in Gmail, Outlook Web, and Yahoo Mail. Clicking it returns a risk badge (Safe / Caution / High Risk), key suspicious signals such as look-alike domains, invoice anomalies, payment changes, and phishing links, and — on Pro — a plain-English explanation and recommended next step. It runs only when you click, with no background scanning.
• Free vs. Pro: Free includes core signals (Sender Trust, Link Safety, Content Safety, Auth Score), risk badges, and 3 AI deep scans per day on 1 device. Pro adds unlimited deep analysis, detailed breakdowns, explanations, and priority support. Plans are Monthly ($9.99/mo, 1 device), Yearly ($79.99/yr, 3 devices), and Lifetime ($129 once, 5 devices), with checkout via Stripe and activation details emailed after payment.
• How to choose: If you handle invoices and payments daily and want a fast verdict plus an explanation, Pro's unlimited scans fit that volume. If you only want a quick second opinion on occasional suspicious mail, the free tier's 3 daily scans may be enough. Either way, keep the manual sender, link, and payment checks — a badge is a prompt to look closer, not a replacement for verifying bank details by phone.

The core habit is simple: verify the sender, inspect the link, match the payment details to your own records, and never let urgency push you past those steps.