An email address check tells you whether the address itself has been seen in risky contexts. It cannot tell you whether a person is honest.
Email is where most scams arrive and where most accounts are recovered. A check on the address is therefore worth doing before you reply, before you pay and before you click.
The important detail is that the address is the part you can verify. The display name is free text, and a message from your bank's name is not a message from your bank.
What to paste in
- The full address including the part after the @, which is the only part that identifies an organisation.
- Paste it, do not retype it — a lookalike character is exactly the sort of thing retyping erases.
- If the message is an invoice or a payment request, also paste the reply address separately; it is often different from the sender, and it is usually the fraud.
What the result means
- Exposure found: the address has appeared in breach data that is public or licensed. That is a fact about the address, not proof of intent.
- Nothing found: the address is not in the data available to this site. Newly created addresses, which is what most scams use, frequently appear clean.
- Risk signals from the domain: disposable mail domains, domains registered very recently, and names that imitate a brand are useful indicators regardless of what the individual address has done.
The habits that catch what a check cannot
- 1Read the actual address, then decide. A familiar name in the display field proves nothing.
- 2Never act on urgency alone. Pressure to act within minutes exists to stop you verifying.
- 3Open the service yourself. Use your own bookmark or app rather than any link in the message.
- 4Pay attention to the reply address on invoices and payment requests, which is where the real destination is shown.
- 5Check the address here, read the reasons, and keep the message. Evidence is still useful after the fact.
Frequently asked questions
Can I tell if an email is a scam from the address alone?
Often, yes: a lookalike domain, a disposable mail provider or a freshly registered domain is a strong signal. But a clean address proves nothing on its own, because new addresses are cheap.
Is an address found in breach data dangerous?
Not by itself. It means the address is widely known, so expect more unsolicited mail. Be more careful if the breach also involved personal facts that could be used in a message.
Should I reply to ask if a message is genuine?
Not to the address in the message. Contact the organisation through your own route — a saved number, a typed web address, or the app — and ask there.
Written by The BaitScan team
Last updated September 16, 2026
Results are automated risk estimates based on public indicators and heuristics.