Spot the Fakes & Handle Attachments Safely: The 30-Second Check Before You Click

July 19, 2026 • Cybersecurity

A clean, well-sorted inbox has a hidden superpower we touched on last week: when you know what your REAL email looks like, the fakes start to stand out. This week we turn that into a skill — a 30-second check you can run on any suspicious email — because the email scams are getting good, and the ones that work all arrive the same few ways.

This isn't another general "watch out for scammers" lecture. This is email-specific, and it's the same playbook whether you're a homeowner, a small-business office manager, or a non-profit volunteer who handles the donor mailbox.

The three fakes that actually get people

• The fake invoice. "Your invoice #4471 is attached — payment overdue." It looks like a real bill. At a business, somebody pays it. At home, somebody panics and clicks.
• The fake delivery notice. "Your package couldn't be delivered. Update your address here." Especially effective when you actually ARE waiting on a package.
• The fake boss / fake treasurer. "Hi, I'm in a meeting — can you grab three $500 gift cards real quick? I'll pay you back." The owner's name is on it. It is not the owner.

The 30-second check (run it on ANY email that asks you to do something)

1. Look at the actual sender address — not the name. The name might say "Amazon." Click or hover on it to see the real address behind it. amazon-delivery-support@mail-ru.co is not Amazon. This one move catches most fakes.
2. Hover over the link before clicking (don't click yet). On a computer, rest your mouse on the button or link and look at the bottom of the screen — it shows where it REALLY goes. If the email says "UPS" but the link goes to bit.ly/xy7 or some address that isn't ups.com, stop.
3. Ask: were you expecting this? An invoice from a vendor you've never used. A delivery notice when you ordered nothing. A gift-card request that's "urgent." Surprise + urgency is the scammer's whole formula.
4. When in doubt, go around the email. Don't reply, don't click. Open a new browser tab and type the company's real website yourself, or call the person on the phone number you already have. If "the boss" emailed for gift cards, call the boss's actual cell.

Thirty seconds. That's the whole defense. Slow down, check the sender, hover the link, go around when unsure.

Attachments: the safe way to open one

Attachments are where a careless click does the most damage. Here's the safe habit:

• Did you expect a file from this exact person? If yes, you're probably fine. If it's a surprise — even from someone you know — pause. Hacked accounts send real-looking emails to everyone in their contacts.
• Beware these file types in particular: anything ending in .exe, .zip, .scr, or a "document" that asks you to "Enable Editing" or "Enable Macros" when you open it. Real documents don't need you to enable anything to be read. That pop-up is the trap.
• Preview before you download. Both Outlook and Gmail let you peek at a PDF or Word file right in the browser without downloading it. Preview is safer than download.
• If it feels off, confirm by phone. "Hey, did you just send me a zip file?" takes ten seconds and has saved more small businesses than any software.

What to do if you already clicked

No shame — it happens to careful people. If you clicked a link and typed your password into a page that now feels wrong: change that password immediately (from a different device if you can), and turn on two-factor authentication so a stolen password isn't enough by itself. If it was a work account, tell whoever handles your IT right away. Fast beats perfect.

A tidy inbox and a 30-second habit will keep you safer than almost anything you can buy. Next week we finish the series with the fun part — finding any email in seconds and looking polished while you do it.

Our free Email Scams course in Skits' Classroom walks through real examples of these fakes side-by-side. And if you ever get an email and think "is this real?" — that's exactly what Skits is for. Ask him, or call Jerry at 540.303.2410. We'd rather you ask and be sure.