Is this email a scam? Check it before you click

Scam emails copy the tax office, TV Licensing, PayPal or Netflix, and most want the same thing: for you to click a link, open an attachment or call a number. Check where a link really goes before you do.

Updated 12 October 2026 · 6 min read

Check an email link now

Check one now

Paste the link from the email

Emails hide their links behind words like “Pay now”, so copy the link itself and paste it here. Peekray shows where it really goes, with a clear answer such as Safe, Check first or Scam. You can paste the email’s text as well, and it checks up to 8 links.

On a computer, right-click the link and choose Copy link (or Copy link address). On a phone, press and hold the link, then tap Copy link.

On a computer, Peekray’s free Chrome extension does this as you read your email in Gmail or Outlook in the browser: rest the pointer on a link and a tag shows where it goes. Get the extension

Only the web addresses in your message are sent for checking. Our server never reads or keeps the rest of it.

Got a QR code?

Check it before you open it. The code is read in your browser, and only a web address in it is sent for checking.

Spot it

Six signs of a scam email

Phishing and spoofing were the crimes most reported to the FBI’s Internet Crime Complaint Center in 2025, with 191,561 complaints.

  1. 01

    The sender isn’t who the name says

    Scammers can change the name an email shows, and even fake the address. Click or tap the sender’s name to see the full address and check it’s the organisation’s real one. A real-looking address isn’t proof on its own.

  2. 02

    It rushes or threatens you

    “Respond within 24 hours”, “your account will be closed”, a fine if you don’t act. The pressure is there to stop you checking.

  3. 03

    It wants you to sign in, pay or confirm details

    A problem with your account or payment, a refund to claim, details to “verify”. The FTC says real companies won’t email you out of the blue with a link to update your payment or account details.

  4. 04

    The link doesn’t go to the real website

    Rest the pointer on a link without clicking, or press and hold it on a phone, to see where it really goes. Read the site name from the right: paypal.com.account-help.example is really account-help.example. Watch for lookalikes too, like amazan instead of amazon.

  5. 05

    An attachment or QR code you weren’t expecting

    Attachments can install harmful software, and scammers increasingly put QR codes in emails to get you onto a scam site from your phone. Don’t open or scan them unless you were expecting them.

  6. 06

    It wants you to call a number

    Fake invoices and renewal emails say you’ve been charged and must call within 24 hours to dispute it. The number goes to the scammers. Use a number from the company’s own website or app instead.

Good spelling doesn’t make an email real: CISA warns that, with AI, some scam emails now have perfect grammar and spelling.

Know the script

Scam emails doing the rounds

Made-up examples based on real scams. Their links end in .example, a name kept for examples, so they lead nowhere, and the phone number is one kept for fiction.

  • UKPretends to be HMRC

    A tax refund to claim

    An example scam email from HM Revenue & Customs

    From: HM Revenue & Customs <refunds@hmrc-refunds.example>

    You are due a tax refund of £326.40

    Our records show you have overpaid tax. Confirm your details before the refund expires.

    Claim your refund

    Really goes to: hmrc-refunds.example/claim

    The facts

    HMRC warns that scammers can copy a genuine email address or change just the name it shows, and says not to click the links in a “tax rebate” email. Forward it to phishing@hmrc.gov.uk.

  • UKPretends to be TV Licensing

    A refund for paying twice

    An example scam email from TV Licensing

    From: TV Licensing <billing@tvlicence-refund.example>

    You are due a TV Licence refund

    Our records show you paid twice for your licence. Click below to access your refund.

    Get my refund

    Really goes to: tvlicence-refund.example/refund

    The facts

    TV Licensing says it would never process a refund by asking for your card or bank details, and only emails you about payments if you’ve missed one.

  • UKPretends to be DVLA

    A vehicle tax refund

    An example scam email from DVLA

    From: DVLA <notice@dvla-refunds.example>

    Vehicle tax refund: action needed

    You are entitled to a vehicle tax refund of £82.50. Confirm your bank details so we can send it.

    Confirm details

    Really goes to: dvla-refunds.example/confirm

    The facts

    DVLA says it will never ask for your bank account details or ask you to confirm payment details, and that vehicle tax refunds are issued automatically, never through an email with a link.

  • USPretends to be the IRS

    A tax refund notification

    An example scam email from Internal Revenue Service

    From: Internal Revenue Service <refunds@irs-refund.example>

    Tax refund notification

    You are eligible for a tax refund of $1,280.00. Verify your information to receive your refund.

    Verify now

    Really goes to: irs-refund.example/verify

    The facts

    The IRS says it doesn’t make first contact by email or social media: a letter or notice comes first. Send IRS scam emails to phishing@irs.gov.

  • USPretends to be a seller on PayPal

    An invoice with a number to call

    An example scam email from PayPal

    From: PayPal

    A real PayPal invoice, sent by a scammer

    You’ve got a new invoice: $649.99

    Note from seller: Your order will be processed today. If you didn’t make this purchase, call our support team to cancel:

    +1 (212) 555-0163

    The facts

    PayPal says scammers can send invoices and money requests through PayPal itself, with a note asking you to call their fake customer service number. Don’t call it or pay: log in to the PayPal app or website yourself to check.

  • USPretends to be Netflix

    A payment that didn’t go through

    An example scam email from Netflix

    From: Netflix <billing@netflix-account.example>

    Your account is on hold

    We couldn’t process your last payment. Update your payment details within 48 hours to keep watching.

    Update payment

    Really goes to: netflix-account.example/billing

    The facts

    Netflix says it will never ask you to share your personal information in a text or email. To check your account, open the Netflix app or type netflix.com yourself.

Before you click

See where an email link really goes

  1. 01

    On a computer

    Rest the pointer on the link without clicking. The real address pops up, near the link or at the bottom of the window. Check it’s the company’s real website.

  2. 02

    On a phone

    Press and hold the link instead of tapping it. A preview shows the real address. Tap Copy link to paste it into Peekray.

  3. 03

    Read the site name from the right

    Find the first single “/” after https://. The name just before it is the site you’d really visit. In paypal.com.account-help.example/login, that’s account-help.example, not PayPal.

Got one?

What to do with a scam email

  1. 1

    Don’t click its links, open its attachments, scan its QR codes, call its numbers or reply.

  2. 2

    If it might be real, go to the company yourself: open its app, or type in its web address. For your bank, call the number on the back of your card. In the UK, you can also dial 159.

  3. 3

    Report it (see below), then delete it.

Already clicked the link? What to do now

Report it

Where to report a scam email

In the UK

Any scam email
Forward it to report@phishing.gov.uk.
Posing as HMRC
Also forward it to phishing@hmrc.gov.uk.
Lost money
Tell your bank, then report it to Report Fraud at reportfraud.police.uk or on 0300 123 2040 (England, Wales and Northern Ireland). In Scotland, call Police Scotland on 101.

In the US

Any scam email
Forward it to reportphishing@apwg.org, and report it to the FTC at ReportFraud.ftc.gov.
Posing as the IRS
Send it to phishing@irs.gov as an attachment.
Posing as PayPal
Forward it to phishing@paypal.com.
Lost money
Tell your bank, and report it to the FBI at ic3.gov.

You can also report it in your email app. In Gmail on a computer, click More (⋮) next to Reply, then Report phishing. In Outlook, choose Report, then Report phishing.

Let Peekray do it

Check the next email link before you click.

Add to Chrome, it’s freeCheck on your phone

FAQ

Common questions

How can I tell if an email is a scam?

Check who really sent it, whether it rushes you, whether it wants you to sign in, pay or call a number, and where its links really go. Treat a surprise email that pushes you to act through a link or a phone number as a scam until you’ve checked. Copy the link into Peekray to see where it goes.

Is it dangerous to open a scam email?

Most scam emails need you to do something: click a link, open an attachment, scan a code, reply or call a number. The FTC warns that attachments and links can install harmful malware, so don’t click, open or reply. Report the email, then delete it.

Can scammers fake the sender’s email address?

Yes. The FBI says spoofing can disguise an email address or a sender’s name, and HMRC warns that scammers may copy a genuine address. A real-looking address isn’t proof, so check where the links go, or contact the company yourself.

Should I click unsubscribe in a scam email?

No. CISA says to delete the message and not to click any link in it, including an “unsubscribe” link. Use your email app’s own report or block option instead.

I clicked a link or typed in my password. What now?

Change that password, and anywhere else you use the same one. Turn on 2-step verification, and check your email’s forwarding rules. If you gave card or bank details, call your bank now. Peekray’s guide to what to do after a scam link takes you through it.

Does Peekray read my emails?

No. When you paste an email here, Peekray picks out the links on your device and sends only those web addresses to check. The extension sends only the link you point at, its text and the page title, with email addresses and long numbers taken out of the title.

Sources

Where this advice comes from

Guides

More help