Email• 5 min read
Email Phishing in 2026: How to Read a Header Like a Pro
AI has made phishing emails grammatically perfect. The give-aways have moved from the body to the header.
Display name vs sending address
'PayPal Support' <noreply@pp-secure.win> is a scam. Always tap the name to see the real address.
SPF/DKIM/DMARC fail
In Gmail, click 'show original' — any 'fail' on these checks is a strong scam signal.
Look-alike domains
rnicrosoft.com (r-n-icrosoft) vs microsoft.com.
Urgent CTAs
'Verify in 24 hours or your account is suspended' — real companies do not work like this.
The bottom line
Forward the email (or a screenshot) to ScamGuard on WhatsApp for an instant phishing verdict.