How to Check a Suspicious Email in Under a Minute

It's sitting in your inbox right now. Maybe it says your account is suspended, your parcel couldn't be delivered, or your tax refund is ready. Something about it feels off — but it looks real, and part of you wonders if ignoring it will cause a problem.

Here's the good news: you don't need to be technical to check it. You need about a minute.

---

First, the 20-second eyeball checks

Before anything else, three things you can check without clicking a single link:

• The sender's actual address — not the display name. "Australia Post" can be typed by anyone; the address behind it can't be faked as easily. Tap or hover on the sender's name and look at the part after the @. auspost.com.au is Australia Post. auspost-delivery-au.info is not.
• Where the links really go — without clicking. On a computer, hover over the link and look at the address that appears in the corner of the window. On a phone, press and hold the link (don't tap) and a preview appears. If the text says "myGov" but the address is a jumble of letters, you have your answer.
• The pressure — real organisations rarely need you to act "within 24 hours" or face consequences. Urgency is the scammer's main tool, because a person in a hurry doesn't check things.

If any of those three fails, treat the email as hostile. But often the eyeball checks come back ambiguous — the address looks plausible, the links are hidden behind a "view message" button, and you're still not sure.

That's what the next step is for.

---

Then, the one-minute definitive check

Forward the email to scan@askarthur.au.

That's the entire process. No app, no signup, no copy-pasting into a website. Just the forward button you already use.

About a minute later, a reply lands in the same email thread with:

• A verdict — safe, suspicious, or high risk, in plain English.
• The red flags — exactly what was wrong with it, so you learn the pattern for next time.
• What to do next — including where to report it if it's a scam.

Arthur (that's our scam-checking AI) reads the email the way a fraud analyst would: the sender's domain, the links, the language patterns, the impersonated brand — checked against a live database of scams reported by other Australians.

It's free, with a limit of three checks a day per person.

---

If it turns out to be a scam

• Don't reply, don't click, don't unsubscribe — the unsubscribe link in a scam email just confirms your address is live.
• Report it at Scamwatch — every report makes the next person safer.
• Delete it. That's it. Receiving a scam email doesn't mean you've been hacked; your address is simply on a list, like almost everyone's.

And if you clicked before you checked — that's human, not foolish. These emails are built by professionals to beat your instincts. Change the password on the affected account, tell your bank if payment details were involved, and have a look at what to do if you've been scammed.

---

The habit worth building

Phishing cost Australians $97.6 million in 2025, according to the ACCC's Targeting Scams report — and email remains one of the most common ways in. The defence isn't becoming a technical expert. It's building one small habit:

When in doubt, forward it before you act on it.

Forward your next suspicious email to scan@askarthur.au and see what comes back. Free, no signup, verdict in about a minute.