Guides
Answer the question before the email creates urgency.
Use these field guides to verify an account safely, preserve the right evidence and choose a response that fits the technical facts.
Fake MyChart email, redirect chain and subscription funnel
Follow a real same-day investigation from original-message preservation through provider reports and a hosted object becoming inaccessible.
Read the case study →PaymentsIs this payment-declined email real?
Payment-declined phishing creates urgency around a card, subscription or delivery. Verify the account through a known app or saved address before you act.
Read the guide →Document luresHow to check a DocuSign phishing email
Document-signing lures borrow familiar branding and an expected business action. Confirm the envelope and sender through an independent route before opening it.
Read the guide →Cloud accountsHow to recognize a fake iCloud storage email
Fake storage notices threaten lost photos, disabled mail or failed backups. Your Apple device can show the real storage and billing state without using the email.
Read the guide →QR phishingQR-code phishing in email
A QR code hides a destination from ordinary link previews and moves the decision onto a phone. Treat it as a concealed link, not as proof of the sender.
Read the guide →Business domainsHow to stop people spoofing your company email
Exact-domain spoofing is reduced through aligned SPF, DKIM and DMARC. The dependable order is inventory, observe, correct and then enforce.
Read the guide →Apple MailHow to report several phishing emails on iPhone
Apple Mail can move a batch of messages into a synchronized reporting folder. This preserves each original without forwarding every copy.
Read the guide →Mailbox workflowHow to use your Junk folder as a phishing review queue
A server-side Junk folder can collect suspicious mail from phone and desktop apps, but it needs a private approval step because spam filters make mistakes.
Read the guide →Message evidenceEmail headers explained in plain language
Email headers record several identities and delivery events. Reading them in the right order is more useful than searching for one suspicious word.
Read the guide →Abuse reportingHow to report phishing to a hosting or network provider
A useful abuse report identifies the provider's role and gives reproducible evidence. A vague accusation or domain name alone often produces a dead end.
Read the guide →ImpersonationEmail spoofing versus a lookalike domain
Exact-domain spoofing and lookalike domains can appear similar in an inbox, but they require different evidence and controls.
Read the guide →Link analysisWhy phishing links use redirect chains
A phishing button may pass through several domains before reaching a final page. Each hop has a different role, and the first visible domain may not host the lure.
Read the guide →