How To: Check the Email Sender is Valid

In short. The display name is cosmetic. The email address is the claim. Expand it before you trust the brand.

Display name is not the sender

Clients show a friendly name first: “Meridian Bank”, “Conglomcorp IT Helpdesk”, “Clive Marsh”. That string is chosen by the sender. It is not verified.

The real claim is the address, usually in angle brackets: alerts@meridianbank.example. In Gmail and Outlook, click or hover the name so the full address appears.

A matching display name is not proof of authenticity.

Read the whole address

Attackers count on you stopping at the first familiar word.

• Lookalike letters — mer1dian (digit 1), conglomc0rp (zero), webv1deos.
• Extra words — conglomcorp-it-help.example is not conglomcorp.com.
• Wrong host — meridianbank-secure-login.example is not the bank’s domain.

Read the part after @. One substituted character is enough.

Reply-To can disagree with From

Even when From looks right, Reply-To may point somewhere else.

• Genuine Meridian keeps Reply-To on alerts@meridianbank.example.
• A spoofed “verify” mail can keep that From line while Reply-To sits on help@mer1dian-alerts.example.

Hitting Reply would talk to the attacker.

Example

A CEO-style wire can show:

• Display name: Clive Marsh
• From: clive.marsh@conglomcorp.com
• Return-Path: assistant@conglomcorp-exec.example

The inbox chip looks internal. The envelope sender is a different organisation. That is email spoofing — treat it as hostile until SPF, DKIM and DMARC say otherwise.

In the simulator

• Open Email headers.
• Compare From with Reply-To and Return-Path. They should tell the same story.