Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
A logo, familiar display name, or polished writing does not prove an email is genuine. Check the full sender address and link destinations without opening them, then verify any account or billing claim by going directly to the company’s official site. If the message still looks suspicious, report it through your email provider’s phishing control and the appropriate reporting channel—without clicking, replying, or opening attachments.
How to tell whether an AI-company email is phishing
Start with the sender details, not the branding. Expand the sender information and inspect the complete address and domain. Watch for misspellings, unexpected subdomains, or a domain that does not match one you independently verified. A sender address can be spoofed, so even a plausible-looking address is not proof by itself.
Check where each link leads without following it. Use your email client’s safe link preview or hover over the link on a computer; do not click it to inspect the destination. Be cautious of shortened links, a destination that differs from the text shown, or a login page reached through an unexpected email. The FTC notes that scammers can spoof logos and invent addresses, and recommends checking the actual sender address and link destination: FTC: How to Recognize and Avoid Phishing Scams.
- An unexpected warning about billing, account access, or security—especially one that pressures you to act immediately.
- A request to provide a password, payment details, or other sensitive information by email or through an unfamiliar link.
- An unexpected attachment or a request to reply with account information.
Do not treat polished grammar as a sign that the message is safe. Archived CISA guidance notes that AI-generated messages may have polished grammar; that page is marked archived, so use the point as a reminder to check other signals rather than as current company-specific policy: CISA: Recognize and Report Phishing.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How to verify a message safely
- Do not use the email’s contact details. Avoid its links, phone numbers, reply address, and login buttons.
- Go to the service independently. Type a known official address yourself or find the company’s site through a trusted source, then sign in there if needed.
- Check the claim in your account. If the email mentions a subscription, payment, or security problem, look for it in the official account interface or contact support using details from the verified site.
- If uncertainty remains, treat the email as suspicious. Do not reply to ask whether it is real.
These steps follow FTC advice to verify unexpected claims using contact information you know is genuine, rather than information in the message: FTC: How to Recognize and Avoid Phishing Scams.
How to report a suspicious email
Report it to your email provider
Use the message’s built-in Report phishing control, or the provider’s equivalent. Do not click links, open attachments, reply, or use the email’s unsubscribe link. After reporting, delete the message. Provider controls and labels vary, so look in the message menu or toolbar.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Report it to consumer-protection channels in the United States
The FTC advises US readers to forward phishing emails to the Anti-Phishing Working Group at reportphishing@apwg.org and report the attempt at ReportFraud.ftc.gov. These are US reporting channels; readers elsewhere should use their country’s official consumer-protection or cybercrime reporting guidance rather than assume these routes apply locally. The FTC’s consumer guidance is here: FTC: How to Recognize and Avoid Phishing Scams.
Free tools Windows power users keep installed
One-click scans. No signup required.
Notify the company being impersonated
Use contact details or a reporting form found on the company’s verified official website. The FTC advises businesses whose identities are being misused to tell the impersonated company or person: FTC business guidance on phishing.
Rank #3
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
For suspected OpenAI account fraud or unauthorized account activity, OpenAI directs users to its Fraudulent Activity webform. Select “Report unauthorized activity involving my account.” This form is for suspected account-related fraud or unauthorized activity; OpenAI’s guidance does not identify it as the general reporting route for every unclicked spoof email.
Use workplace channels for work accounts
If the message reached a work account, follow your employer’s incident-reporting process and use the email platform’s reporting controls. Joint guidance from CISA, NSA, FBI, and MS-ISAC discusses organizational reporting and agency routes: Joint advisory AA23-074A. Its channels are intended for organizational incidents, not as the default consumer process.
Rank #4
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
What to do if you already clicked or shared information
If you entered a password
- Go to the real service using an independently verified address and change the exposed password.
- Change it anywhere else you reused it.
- For an OpenAI account, OpenAI advises changing your password and logging out of all sessions. If an API key may have been exposed, rotate it. Report suspected account fraud through the Fraudulent Activity webform described above: OpenAI account-fraud guidance.
If you shared personal or financial information
For readers in the United States, the FTC directs people to IdentityTheft.gov for recovery steps based on the information exposed: FTC phishing guidance. If you are outside the US, contact the relevant official identity-theft or financial-fraud service in your country.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsIf you opened an attachment or may have installed malware
Update your existing security software and scan the device, as the FTC recommends in its phishing guidance. If this involved a workplace device or account, notify your employer’s IT or security contact promptly and follow its incident process: FTC phishing guidance and joint organizational advisory.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
