How Can You Tell Who an Email Is Really From?
How can you tell who an email is really from?
Look at the actual email address, not the name. The name is whatever the sender typed in.
That one thing is what gave away the fake "Tom Bruch" email some of our clients got in September 2026. The name at the top said Tom Bruch. The address right next to it was a Gmail account made to look close to ours. Anybody can type "Tom Bruch" into a name field, it takes about four seconds.
Where do you find the real address?
On a computer it's usually right next to the name, or it shows up when you hover over the name. On a phone, tap the sender's name and the full address appears. It takes two seconds, and most people never do it.
Then read it slowly. Scammers love addresses that are almost right: an extra letter, an "s" on the end, a dash in the middle, or the company's name sitting in front of @gmail.com. Ours had all the right words, just in the wrong place.
Where else does a fake give itself away?
Hit reply and look at who it's actually going to before you type anything, because the reply-to address can be different from the sender. And before clicking a link, hover over it (on a phone, press and hold) to see where it really goes.
What if the address looks right?
Then it gets harder, and this is the part that matters most. A good fake can come from a real account that got hacked, or from an address so close you'd never catch it. So when money is involved, don't make the decision on the address alone.
If an email asks you to pay something, change where you send payments, or send personal information, check it some other way first. Call the person at the number you already have, or start a brand new email to the address you've always used for them. Never use the phone number or the link that's in the email itself.
And this isn't just about your web person. Your bookkeeper or your supplier can be faked exactly the same way.
Frequently asked questions
Is an email from a Gmail address always fake?
No, plenty of small businesses run on Gmail. It just means the address alone can't tell you much, so the phone call matters more.
Can someone send an email using my real address?
They can try. Whether it gets through depends on settings on your domain called SPF, DKIM and DMARC. Ask whoever handles your email whether those are set up.
Should I report fake emails?
Mark it as spam or phishing so your email provider learns from it. If it's pretending to be a company you know, tell that company too, so they can warn everybody else.
What if I already replied?
Stop replying and don't send anything else. If you gave out a password, change it. If you paid anything, call your bank today.
Let's talk
If you get an email that says it's from us and something seems off, call me at 979-217-1544.
Tom Bruch has built websites since 1998 and is the owner of Aggieland Website Design.