You receive an email that looks official. It says it is from the Electricity Department, your bank, Amazon, or another company you know. The message sounds urgent, and it asks you to pay, verify, reset, or update something immediately.
Email example
From: Electricity DepartmentSubject: Your electricity will be disconnected todayMessage: Pay Rs. 2,450 immediately using the link below.Check the Real Sender Address
At first glance, this may look genuine. But before paying or clicking anything, check the actual sender email address. The display name is not enough.
Sender Name Is Not Sender Identity
The sender name can say anything: HDFC Bank, Amazon Support, Electricity Department, or your company name. Anyone can type that display name while sending an email.
Compare these sender addresses
Looks genuine: billing@company.comLooks suspicious: company-bill@gmail.comMore deceptive: payment@company-secure-billing.comThe important part is the real email address and domain after the @ symbol. A message may show Amazon in the sender name, but if the actual address is amazon-security@gmail.com, that is a warning sign.
Simple Rule
Do not check only the display name such as From: Amazon. Check the actual address, such as support@amazon.in. Even then, do not blindly trust the message if it asks you to act urgently.
- Pay urgently
- Share an OTP
- Reset your password
- Download an attachment
- Update KYC
If the message asks for any of these, open the company's official app or website yourself instead of clicking the email link.
Real-Life Example
Suspicious email
Message: Amazon: Your account will be blocked. Verify now.Sender: amazon-security@gmail.comAmazon may be written in the sender name, but the actual domain is gmail.com. That mismatch is the warning sign.
Remember
Sender Name does not equal Sender Identity. Always check the actual email address. Don't trust. Verify.
Series
Internet Security Basics: 10-Part Series for Everyday UsersA 10-part series for everyday users to identify scams, protect accounts, and use the internet with more confidence.
Is This Email Really From Your Bank or Company?
Check sender names, email addresses, and urgent payment messages before trusting them.
Can You Spot the Real Website?
Learn how fake domains, confusing links, and lookalike names trick everyday users.
HTTPS Does NOT Mean the Website Is Genuine
Understand what the lock symbol protects, and why you still need to verify the domain.
Does a Professional Domain Extension Mean the Website Is Genuine?
Learn why .com, .org, .in, .net, and .ai do not automatically prove trust.
The Link Says SBI, But Where Does It Actually Go?
Learn why visible link text and button labels can hide a completely different destination.
Sir, Please Tell Me the OTP for Verification
Learn why OTPs, passwords, UPI PINs, recovery codes, and remote access must stay private.
Scan This QR Code to Receive Your Refund
Learn how QR codes can hide payment requests, fake links, and UPI PIN traps.
Someone Sent You BankKYC.apk on WhatsApp. Should You Install It?
Learn why APKs, cracked software, and fake apps can hide malware or dangerous permissions.
Which Airport Wi-Fi Is the Real One?
Learn how fake public Wi-Fi names and captive portals can trick users into unsafe logins.
Before You Click, Pay or Login, Take 30 Seconds
Use a quick checklist before reacting to urgent messages, links, payments, or login prompts.
Nikhlesh Yadav is a Technical Lead and Solution Architect with 12+ years of experience across cloud-native systems, distributed platforms, AI integrations, Web3, and cyber security.
Read full profile