Phishing Email Checker

Free phishing email checker for invoice and login scams

Here is the short version: if a message asks you to change a payment, send a gift card, or type a password, stop. This phishing email checker reads From, subject, and body in your browser and lists red flags. It does not visit links and it does not open attachments.

Use it next to the email header analyzer. Headers are the postmark. This page is the story.

What the checker looks for

The scorer is a list of patterns, not a neural net. That is a feature. You can see why it fired.

CISA’s malware, phishing, and ransomware topic and the FBI Internet Crime Complaint Center describe the same families. Microsoft documents tenant-side controls in anti-phishing policies for Microsoft 365. This tool is the two-minute human pass before those controls, or when someone forwards you a message on their phone.

How the band is scored

Each flag adds weight. Money-plus-urgency is heavier than a lone “please see attached.” A bank-like display name on a free-mail From line is heavy. A bit.ly link next to a password request is heavy.

Bands:

• Low: wording looks ordinary. Still verify money requests out of band.
• Medium: two or more weak signals. Read headers. Ask help desk.
• High: payment or credential language plus a domain or link problem. Treat as hostile.

A Low band is not a green light to wire $48,000. Compromised mailboxes send polite, well-spelled invoices. That is the fake wire instruction case study.

Worked sample (the button loads this)

From: First National Wire Desk <treasury@firstnational.example>
Reply-To: payments-update@gmail.com
Subject: Updated wiring instructions: action required
Body talks about a same-day ACH change and a short link.

Expect High. Reply-To is free mail. The subject is urgency plus money. You do not need a sandbox to refuse that.

What to do after the score

1. Do not click. Do not open the attachment on a workstation you care about.
2. Run headers on the same message.
3. Call the vendor or partner on a number from last month’s invoice, not from the email.
4. Send the message to managed help desk or whoever owns security.
5. If you already clicked, disconnect, and treat it as an incident. Use the cybersecurity risk assessment later. Contain first.

FTC’s phishing page is written for people, not only for IT. Finance staff should read it once.

Lookalikes, homoglyphs, and the one-letter swap

Attackers register securetechie-billing.com or swap rn for m. This checker flags a display name that says Microsoft or PayPal on the wrong domain, a few misspellings (micros0ft, paypa1), punycode, and abused TLDs. It will not catch every lookalike. Read the From address, not only the display name. Outlook and iPhone mail hide the address until you tap it. Tap it.

Punycode (xn--) lets a domain look like a brand in some fonts. If you see xn-- in a link, do not click. Paste the text here or into headers. Then call.

QR codes in PDFs are links you cannot hover. If an “invoice” is a QR and a deadline, treat it as a link you did not inspect.

Why finance gets hit

The message is rarely “please send Bitcoin.” It is last week’s vendor, last week’s amount, and a new routing number because “we changed banks.” That is business email compromise. CISA and the FBI publish it because it works. A checker helps the first 30 seconds. A written rule helps the next 30 years: no payment-detail change without a voice call on a number already in the file.

Finance teams in Los Angeles get these on ordinary Tuesdays. Staff are busy. The PDF looks like last week’s. The control is the two-minute process, not a longer training video.

Two failures look the same in the inbox. A spoof often fails SPF or DMARC; the header analyzer will show that. A compromised vendor mailbox often passes. This checker still helps because the story (new routing, same-day ACH, gift cards) is what AP should refuse. Use both tools. Neither replaces a phone call.

Keep a folder of known-good invoices from real vendors. Compare the next “update” against that folder, not against the email’s own letterhead. Teach one person in AP what High means and who to call. Forwarding a suspected phish to the whole firm is how the second person clicks. Send it to one owner.

A normal vendor invoice that only says “invoice attached” can land in Medium. That is not a false alarm you should ignore. It is a reminder to use last month’s phone number. Gift cards and free-mail Reply-To lines should never wait for a second opinion from this page. Refuse those on sight.

What this checker is not

It is not VirusTotal. It is not a sandbox. It will not open a .html attachment. It will not invent a lookalike it cannot see in the paste. It cannot prove a clean vendor mailbox is honest.

If the sender domain is real and DMARC passed, you still call back. Authentication answers “did this domain send it,” not “is this person who they claim.”

Cybersecurity plus a written payment-change rule is the real control. If you want that owned, contact Secure Techies.