Suspicious Email or Number: How to Check a Contact Before Replying
A seller contacts you by email to finalize a purchase, or an unknown number calls you after you posted a listing online. Before you reply, call back or share any information, a few simple checks can save you a lot of trouble.
Key takeaways
- Read the exact domain after the @.
- Search for the full number before calling back.
- Never give a code received by text message.
- Contact the company using its official contact details, not those in the message.
- Report fraudulent messages to the official organizations.
1. Does the email's domain match the company it claims to be?
An address like contact@amaz0n-support.com or service@paypal-secure-fr.net imitates a well-known name without being an official domain. Real companies write from their own domain, not from a variant with a hyphen, a digit in place of a letter, or an unusual extension. Always look at what comes after the @, not just the display name.
2. A generic address for a “company”
A business that only writes from a @gmail.com or @outlook.com address, with no domain of its own or consistent website, is a signal to take into account, especially for a large amount. Plenty of very small honest sellers use this kind of address: it's a clue, not proof.
3. Has the phone number already been reported?
Many internet users publicly report the numbers used for abusive cold calling or scams. Searching for the full number often brings up community directories where other people describe their experience with that same number.
Never call back an unknown number received by text or message without searching for it first. Some premium-rate numbers are designed to make you call back without realizing it.
4. Pressure to reply quickly
“Reply before tonight or the listing will be cancelled”, “Pay directly by bank transfer to speed up shipping”: phrasing like this is meant to make you act before you check. A legitimate contact accepts that you take a few hours. Urgency is a scammer's best ally.
5. Mistakes and an inconsistent tone
Fraudulent messages, written in bulk or machine-translated, often contain odd phrasing, repeated mistakes or a mix of registers (very formal, then suddenly casual). It isn't proof on its own: you need to combine it with the other signals.
6. Attachments and links
Don't click on a payment or “parcel tracking” link you weren't expecting, and don't open an unexpected attachment. Go straight to the company's website instead by typing its address yourself.
The right habit above all
Never share a security code, a password or full banking details following a contact you didn't initiate, even if it seems to come from a service you know. If in doubt, contact the company using the official contact details you found yourself, never the ones given in the message.
Frequently asked questions
How can I check that an email really comes from the company?
Look at the exact domain after the @, compare it with the official website that you type in yourself, and be wary of links hidden behind a button. If in doubt, go through the official website to contact the company.
Is a number that hasn't been reported necessarily safe?
No. A recent number may simply not have been reported yet. The absence of reports is mildly reassuring, but doesn't replace the other checks.
Where can I report a fraudulent text message or call?
In France, you can forward a suspicious text to 33700 or use the 33700.fr website, report an email on Signal Spam, and report a scam site on the Pharos platform (internet-signalement.gouv.fr). In another country, look for the equivalent organization.