If you receive a security alert email claiming to be from Google, Apple, Microsoft or another provider, do not click any link in it until you have verified it independently. The safe method is to open the account directly in your browser or app, check the security or activity section there, and compare what you see with the email. Genuine alerts will usually be reflected in your account's recent activity; phishing emails often are not. This guide walks through that check, plus the sender, link and header clues that help you decide.
Why security alerts are a favourite phishing disguise
Security alerts work well as bait because they create urgency and fear. A message saying “new sign-in from an unrecognised device” or “unusual activity detected” pushes you to act quickly, often by clicking a button to “secure your account”. That button may lead to a fake login page designed to capture your password, or to a page that asks for a one-time code, which the attacker then uses to break into the real account.
Real providers do send these emails, so you cannot simply ignore every alert. The skill is telling the genuine ones from the fakes without relying on the email itself. That means verifying through a separate channel: your own app or a typed-in web address.
Is this security alert email real? Start by opening the account yourself
The single most effective habit is to ignore every link and button in the email and go to the service directly. Type the address you know (for example, the provider's main website) into your browser, or open the official app on your phone. Sign in as normal. Then look for the security or activity area:
- Google: open your Google Account, then Security, then “Your devices” or “Recent security activity”.
- Microsoft: open your Microsoft account security page and review recent activity and sign-in attempts.
- Apple: on a trusted device, open Settings, tap your name, then review devices signed in to your Apple Account.
If the alert was genuine, you will usually see the same event listed there — a new device, a sign-in from a new location, or a password change. If your account shows nothing unusual, the email is very likely fake. This check works because a phisher can copy an email's look but cannot insert events into your real account's activity log.
How do I check the sender address and links without clicking?
Phishing emails often show a friendly display name such as “Google Security” while the actual address is something else entirely. In your email client, expand the sender details to see the full address. Look at the domain — the part after the @ symbol.
Be careful: a domain can contain a brand name without being the brand's real domain. For example, an address ending in a lookalike domain is not the same as the official one. Providers publish their official sending domains in their help documentation, and those can change, so check the provider's current guidance rather than relying on memory. If the domain does not match the provider's documented domain, treat the message as suspicious.
Also check the “reply-to” address if your client shows it. A genuine security alert rarely asks you to reply, and a reply-to address on a different domain is a warning sign.
On a desktop email client, hover your mouse over a link (without clicking) and the destination URL usually appears at the bottom of the window or in a tooltip. On a phone, press and hold the link to preview the address. Compare the destination with the provider's real domain.
Watch for these patterns:
- A long string of characters before the real-looking domain (the true domain is the part just before the first single slash).
- Misspellings or extra words in the domain, such as a brand name followed by “-secure” or “-verify”.
- Links that go to a URL shortener or a generic file-sharing site.
- Buttons that are actually images with a link behind them — hovering still reveals the destination.
If you are unsure, do not click. Go back and check inside the account instead.
What can email headers tell me about a security alert?
Headers are the hidden routing information in an email. They can show the sending server, authentication results and whether the message really came from the domain it claims. Every major email client lets you view the full headers; the exact menu varies, so search your client's help for “view headers” or “show original”.
Look for authentication results such as SPF, DKIM and DMARC. These are checks your mail provider performs. A “pass” result for the claimed domain is reassuring but not conclusive, because attackers can sometimes send from lookalike domains that have their own valid authentication. A “fail” result is a strong warning. For a plain-English explanation of what these checks mean, see SPF, DKIM and DMARC Explained for Normal People, and for a walkthrough of reading headers, see How to Read Email Headers.
What genuine security alerts usually do — and don't do
Real alerts vary by provider and change over time, so treat these as general patterns rather than fixed rules. Genuine security alerts typically:
- Describe an event that actually appears in your account's activity log.
- Come from a domain the provider documents as official.
- Link to the provider's own domain for account management.
- Do not ask you to reply with your password, a one-time code or personal details.
Phishing alerts often:
- Use urgent language and threaten account suspension or loss.
- Ask you to “confirm” your password or identity via a link.
- Ask for a one-time code, or for a code to be sent to a phone number.
- Have a sender domain that does not match the provider.
- Contain links that go somewhere other than the provider's domain.
No legitimate provider will ask you to send them a one-time code. If an email does, it is a phishing attempt, regardless of how official it looks.
When the alert might be real — and what to do next
If your account's activity log shows the sign-in or change described in the email, treat it as real. Change your password from inside the account, review connected devices and apps, and remove anything you do not recognise. Turn on two-factor authentication if it is not already enabled; app-based codes or passkeys are generally stronger than SMS. For a comparison, see Two-Factor Authentication Explained.
If you already clicked a link and entered your password, change it immediately from a device you trust, then review active sessions and revoke any you do not recognise. If you entered a one-time code, check whether any new sessions or forwarding rules were added. For a broader checklist, see What to Do After a Data Breach Exposes Your Email.
Where disposable inboxes fit — and where they don't
Disposable inboxes are useful for low-stakes signups, but they are a poor choice for accounts that will send security alerts. A disposable inbox expires, so a genuine “new sign-in” alert sent later may never reach you, and you cannot use it to recover an account. If you used a temporary address for an account that now matters, move that account to a permanent address you control. For the trade-offs, see Temp Mail vs VPN vs Email Alias and Is Temp Mail Safe?.
If you do use a temporary inbox for a signup and then receive a security alert there, verify it through the account itself rather than trusting the email. You can open a fresh inbox at MailboxTemp when you need one for a low-risk signup, but keep important accounts on a permanent address.
Sources
- Google Account Help — “Recognize a phishing email”
- Apple Support — “Recognise and avoid phishing messages, phoney support calls and other scams”
- RFC 6376 — DomainKeys Identified Mail (DKIM) Signatures
In short
Do not trust the email; trust the account. Open the service directly, check recent activity, and compare. Check the sender domain, hover over links, and use headers only as supporting evidence. If the alert is real, secure the account from inside it. If it is fake, delete it and do not click. And keep security-sensitive accounts on a permanent address, not a disposable one.