You open your inbox and see a message saying Your account was accessed from an unknown device in Chennai. The sender name reads SBI Customer Care or Google Security Team. Before you click anything, here is the one thing you must know: the name shown in your inbox can be set to anything the sender likes. It tells you almost nothing about who actually sent the email.
In 2025, Indians lost over Rs 19,812 crore to cyber fraud, with more than 21 lakh complaints received via the National Cyber Crime Reporting Portal, according to the Indian Cyber Crime Coordination Centre (I4C). Many of those cases started with a fake security email. Learning to check the real sender takes about two minutes, and it can protect your bank account, your phone data, and your personal information.
Why the Sender Name in Your Inbox Cannot Be Trusted
When an email arrives, your inbox shows two things: a display name and sometimes an address next to it. A common tactic used by cybercriminals is to spoof the display name, making a trusted brand appear in your inbox while the actual email address is completely different. A fraudster can name their account HDFC Bank Alerts and it will appear exactly that way in your inbox preview, even if the real address is something like support7281@freemailer.ru.
This is called display name spoofing, and it is one of the most widely used tricks in India right now.
How to Check the Sender of an Account Security Email
Follow these steps in order. Do not click any link in the email until you have completed at least the first three.
Step 1: Click the Sender Name to See the Full Address
In Gmail on a mobile phone, tap the sender’s name. It will expand to show the complete email address underneath. On a desktop, hover over the name and it will appear. In Yahoo Mail and Outlook, clicking on the display name reveals the address behind it.
Once you see the full address, focus on the part that comes after the @ symbol. That is called the domain, and it is the most important thing you will check.
Step 2: Verify the Domain Against the Official Website
The domain is the website address that follows @ in an email. It should match the company’s official website exactly. A genuine email from SBI will come from @sbi.co.in. A real Google security alert arrives from @accounts.google.com or @google.com. ICICI Bank uses @icicibank.com.
Scammers create domains that look almost right. They add a word, swap a letter, or use a different suffix. For example, sbi.alert-secure.com is not SBI. accounts-google.security.com is not Google. Always check the spelling of the domain name, letter by letter, because even a single character difference means the email is not from who it claims.
Here is a quick reference table for some of the most commonly used services in India:
| Service | Official Email Domain |
|---|---|
| SBI | @sbi.co.in |
| ICICI Bank | @icicibank.com |
| HDFC Bank | @hdfcbank.com |
| @accounts.google.com, @google.com | |
| Amazon India | @amazon.in, @amazon.com |
| PhonePe | @phonepe.com |
| Microsoft | @accountprotection.microsoft.com |
If the email you received uses any other domain, even one that looks close, do not click any link inside it.
Step 3: Check the Email Header for the Real Origin
The display name and even the From address can be faked. To go one level deeper, you can read the email header. Think of it as a travel log that shows exactly which server sent the message.
In Gmail, open the email. Click the three vertical dots in the top-right corner of the message and select Show original. A new window opens with all the technical details. Look for the fields labelled Return-Path and Received. Reading the Received headers from bottom to top tells you where the email originally came from, including the sender’s actual address and the server it passed through.
You do not need any technical knowledge for this. You just need to check whether the domain in those fields matches what the email claims. If it does not match, the email is spoofed.
Step 4: Log In Directly to the Platform to Confirm
This step takes under two minutes and is the safest check of all. Instead of clicking any link in the email, open your browser and type the official address yourself for example, onlinesbi.sbi.co.in for SBI, or myaccount.google.com for Google. Log in as usual and check the security section. If there was a real alert, it will appear there too.
As SBI’s own guidelines state, banks will not ask you to verify your account information through email. If a security email is asking exactly that, treat it as a scam.
Red Flags to Spot Without Being a Tech Expert
Not every fake email is easy to catch, but most of them share the same warning signs:
- The greeting says Dear Customer or Dear User instead of your actual name.
- The message creates extreme urgency, claiming your account will be permanently blocked within 24 hours.
- Hovering over or long-pressing on mobile a link in the email shows a URL that does not go to the company’s real website.
- The email contains spelling errors, odd phrasing, or sentences that feel slightly off.
- It asks you to share your OTP, password, CVV, or card number by clicking a link or filling a form.
No legitimate bank, UPI platform, or major online service will ever ask for your OTP or password over email. That is not how account security works on their end.
What to Do If You Suspect the Email Is Fake
First, do not click any link or open any attachment. Second, mark it as spam in your inbox so your email provider can learn from it. Third, report it. India’s national cybercrime helpline is 1930, available round the clock. You can also file a complaint at the National Cyber Crime Reporting Portal, the official portal run by the Ministry of Home Affairs, Government of India.
If your account involves real money, log in directly to that service and check your recent activity. If you notice any change you did not make, contact the service’s official customer care using the number from their official website, not from the email.
For any online platform you use regularly, including gaming or entertainment accounts, always access your account through the platform’s official address. Users of platforms like lotus365 login should apply the same checks described above to any security email claiming to be from that platform. Check that the sender domain matches exactly. The same applies to sports-related accounts on platforms like lotus365 cricket before acting on any account security email, verify the sender domain first.
Quick Recap
Checking the real sender of a security email comes down to three things. Look at the actual email address, not just the name. Check that the domain after @ matches the company’s official website exactly, letter by letter. When you still have any doubt, skip the link entirely and log into your account directly from a fresh browser tab. These three habits take two minutes and cost nothing.