READ THE EVIDENCE

Read the exact sender address, not only the display name. Look-alike domains can authenticate perfectly for the attacker.

Ask whether you expected the message and whether it matches something you actually did.

Credentials, payment changes, gift cards, secrets, administrator access, and unusual urgency require independent verification.

Open the official app or saved website yourself. A familiar brand name inside a long hostname does not make the destination legitimate.

SPF, DKIM, and DMARC identify the sending domain. They do not prove that the domain represents the brand you trust or that the request is safe.

Real accounts can be compromised. High-impact changes should still follow an approved process and a separate trusted channel.