These emails pretend to be from Amazon and claim there's a problem with your order, your account, or your payment method. They want you to click a link and enter your Amazon login or credit card information on a fake website.
Example Subject Lines
"Your Amazon order has been confirmed — $849.99"
"Action Required: Verify your payment method"
"Your Amazon account has been locked"
"Refund Notification: $329.00 has been issued"
Red Flags
Sender address is not @amazon.com (e.g., amazon-alerts@secure-verify.com)
You don't recognize the order or didn't purchase anything
Email asks you to "verify" your payment or account by clicking a link
Urgent language: "Your account will be suspended in 24 hours"
Links point to domains that aren't amazon.com
What To Do
Don't click any links. Go directly to amazon.com and check Your Orders. If there's no matching order, the email is fake. Delete it.
Fake PayPal emails tell you your account has been "limited," there's been an unauthorized transaction, or you need to confirm your identity. They send you to a fake PayPal login page to steal your credentials.
Example Subject Lines
"Your PayPal account has been limited"
"Unauthorized transaction detected on your account"
"Confirm your identity to restore access"
"You sent a payment of $500.00 to [unknown name]"
Red Flags
Greets you as "Dear Customer" instead of your name
Sender is not @paypal.com
Asks you to click a link to "verify" or "confirm" your account
Threatens account suspension or legal action
Contains spelling or grammar mistakes
What To Do
Don't click any links. Open a new browser tab, go to paypal.com directly, and sign in. If there's a real issue, PayPal will show it in your account. Report phishing emails to phishing@paypal.com.
Scammers send emails that look like DocuSign signature requests. Clicking "Review Document" takes you to a fake site that downloads malware or steals your login credentials. These are especially effective because people expect DocuSign emails and act on them quickly.
Example Subject Lines
"Please sign: Agreement for Services"
"Document ready for your signature"
"Completed: Your signed document is ready"
"Action required: Review and sign your contract"
Red Flags
You weren't expecting a document to sign
Sender is not @docusign.net (the real DocuSign domain)
The "Review Document" button links to a non-DocuSign URL
No specific details about what you're signing or who sent it
Asks you to download an attachment instead of signing online
What To Do
If you weren't expecting a document, don't click anything. Contact the supposed sender directly to verify. Real DocuSign emails always come from @docusign.net and link to docusign.net.
These emails claim to be from the IRS and tell you about a tax refund, a problem with your return, or a request for your tax transcript. Here's the key fact: the IRS does not contact taxpayers by email. Any email claiming to be from the IRS is a scam.
Any email that claims to be from the IRS is a red flag by itself
Promises of unexpected refunds or tax credits
Threats of arrest, lawsuits, or license revocation
Requests for Social Security numbers, bank account info, or credit card numbers
Links to sites that aren't irs.gov
What To Do
Delete it immediately. The IRS only communicates by postal mail. If you're concerned about your tax status, go directly to irs.gov or call the IRS at 1-800-829-1040. Forward IRS scam emails to phishing@irs.gov.
These emails claim you've been charged for a subscription renewal — usually Geek Squad, Norton, McAfee, or Microsoft — and tell you to call a phone number to "cancel." When you call, the scammer tries to get remote access to your computer or your credit card information.
Example Subject Lines
"Geek Squad Renewal — $349.99 charged to your account"
"Norton Antivirus Auto-Renewal Confirmation"
"Microsoft Security Alert: Your PC is compromised"
"McAfee Subscription Renewed — Invoice #GS-29481"
Red Flags
You don't have a subscription with the company mentioned
The email asks you to call a phone number to "cancel" instead of providing a website link
Large dollar amounts designed to alarm you into acting quickly
Invoice looks like a plain text email, not a professional receipt
The phone number doesn't match the company's official support number
What To Do
Don't call the number. Check your bank or credit card statement — if there's no charge, the email is fake. If you do have a real subscription, manage it through the company's official website, not through an email.
Fake bank emails tell you your account has been locked, there's been suspicious activity, or you need to update your information. They send you to a convincing replica of your bank's website to capture your login credentials.
Example Subject Lines
"Your account has been temporarily locked"
"Suspicious login attempt detected"
"Important: Update your banking information"
"Unusual activity on your Chase/Wells Fargo/Bank of America account"
Red Flags
Sender email doesn't match your bank's official domain
Generic greeting instead of your name
Asks you to click a link and enter your login, account number, or SSN
Creates urgency: "Respond within 24 hours or your account will be closed"
Your bank already has your information — they don't need you to "verify" it by email
What To Do
Never click links in bank emails. Open your bank's app or type their website address directly into your browser. If something is genuinely wrong with your account, you'll see it when you log in. Call the number on the back of your card if you're concerned.
These scams target businesses and individuals with fake invoices for services never provided, or emails that impersonate real vendors but change the payment details so your money goes to the scammer's account. This is one of the most financially damaging email scams.
Example Subject Lines
"Invoice #INV-2026-4892 — Payment Due"
"Updated banking information for future payments"
"Past due: Payment required within 48 hours"
"Your subscription invoice from [real vendor name]"
Red Flags
You don't recognize the vendor or didn't order anything
A known vendor suddenly asks you to send payments to a new bank account
Invoice details don't match your records
Urgent payment demands with short deadlines
Requests for wire transfers or cryptocurrency payments
What To Do
If a vendor asks to change their payment details, always verify by calling them at a number you already have on file — not the number in the email. Never pay invoices you don't recognize. Verify all payment requests through a second channel.
These emails or texts claim a package couldn't be delivered and ask you to click a link to reschedule delivery or pay a small fee. The link leads to a fake site that steals your personal information or credit card number.
Example Subject Lines
"USPS: Delivery attempt failed — reschedule now"
"UPS: Your package is being held — action required"
"FedEx: Pay $1.99 customs fee to release your package"
"Your package could not be delivered — update address"
Red Flags
You aren't expecting a package
Asks you to pay a fee to receive or release your package
No specific tracking number in the email
Links don't go to usps.com, ups.com, or fedex.com
Arrived via text message with a shortened link
What To Do
USPS, UPS, and FedEx never charge fees via email or text to deliver a package. If you're expecting a delivery, go directly to the carrier's website and enter your tracking number. Don't click links in the message.
Romance scammers build an online relationship over weeks or months, then ask for money. They often claim to be military personnel, oil rig workers, or doctors overseas. These scams start on dating sites or social media but often move to email.
Example Subject Lines
"I need your help — it's urgent"
"I can't access my bank account from overseas"
"I want to come visit you but I need help with travel costs"
"My company hasn't paid me yet — can you help temporarily?"
Red Flags
You've never met this person in real life
They always have an excuse for why they can't video chat or meet
They ask for money via wire transfer, gift cards, or cryptocurrency
The relationship moved very fast — declarations of love within days or weeks
They claim to be stuck overseas due to military deployment, work, or legal problems
What To Do
Never send money to someone you've only met online. Do a reverse image search on their profile photos — scammers often use stolen photos. Talk to a trusted friend or family member before acting. Report romance scams to the FTC at reportfraud.ftc.gov.
Worried someone online might be a scammer? Forward their emails to help [at] checkthis.email and we'll help you evaluate.
10. Crypto & Investment Scams
These emails promise guaranteed returns on crypto or other investments. They may invite you to join a "private" trading platform, claim a celebrity has endorsed a coin, or say you have unclaimed crypto. No legitimate investment guarantees returns.
Example Subject Lines
"Earn $5,000/day with this Bitcoin trading system"
"Guaranteed returns" — no legitimate investment can guarantee profits
Celebrity endorsements for crypto or trading platforms
Pressure to act fast: "Only 10 spots remaining"
Asks you to send crypto to an address or deposit money into an unfamiliar platform
The "platform" isn't regulated or listed on any major exchange
What To Do
Delete it. If an investment opportunity comes to you via email, it's almost certainly a scam. Real investments don't promise guaranteed returns. Never send cryptocurrency to addresses shared in unsolicited emails. Talk to a licensed financial advisor if you're interested in investing.
Got a suspicious investment email? Forward it to help [at] checkthis.email — we'll tell you what's really going on.
When in doubt, check it out
Forward any suspicious email to help [at] checkthis.email and get a plain-language safety report in seconds. Free for everyone.
