FAQ: How Do I Know If That Email Really Came From the Bank? (And What Sales Teams Get Wrong)

We build visitor-intelligence software, which means our team spends its days thinking about how people behave online — and one behavior keeps alarming us even among professionals: smart people, including B2B sales reps handling large invoices, still cannot reliably tell a real bank email from a phishing lookalike. The questions we hear at customer onboarding are the same ones everyone has. So we answered them properly, leaning on a resource we now point every new employee toward: Bank Mails, a publication that documents and decodes the emails banks actually send — fraud alerts, statements, fee notices, and their phishing lookalikes — and teaches readers to tell legitimate bank mail from a scam.

Question one: what is the single fastest check?

Stop reading the email and look at where any link actually goes. Hover over the button — on mobile, long-press — and read the destination URL. A legitimate bank links to its own domain. A phishing email links to a lookalike: hyphens, extra words, or a different top-level domain entirely. This check beats every other heuristic because it is hard to fake convincingly at a glance and impossible to fake once you actually read the destination.

The reason people skip it: they read the text instead. Phishing emails are written to produce urgency ("your account will be closed in 24 hours") so you act on the message rather than inspect the mechanism. The text is theater; the URL is evidence.

Question two: the email uses our bank's logo and exact formatting. Isn't that proof?

No — and this is the most expensive misconception we see. Copying a logo is trivial; the fraud-alert emails that fool people are usually visually flawless. What clones cannot fake is account context. A genuine statement notice knows which account, which period, and which currency you hold. A generic "unusual activity detected" blast addressed to nobody in particular is a mass-produced template. Bank Mails documents this pattern across dozens of real bank emails and their lookalikes, and the contrast between an authentic fee notice and its clone is instructive precisely because the styling matches and the substance does not.

Question three: what should I never do from inside an email?

• Never authenticate through a link in the email. If you want to check your account, type the bank's address yourself or use the app you installed.
• Never reply with credentials, one-time codes, or security answers. No bank asks for an OTP it just sent you — the request itself is the scam.
• Never trust the display name. The "From" field is cosmetic; spoofing it requires no skill.

The practical habit: treat every bank email as a notification that something might be worth checking, and do the checking through a channel you chose.

One more pattern deserves its own paragraph, because it is the one currently doing the most damage in business contexts: the invoice redirect. The email thread is real, the counterpart is real, and only the payment instructions in the final message have been swapped — sometimes sent from a lookalike domain one character off. No credential harvesting, no link inspection required; the fraud lives in the reply-to field. The defense is procedural rather than technical: any change of payment details gets confirmed by phone, on a number you already had, before money moves. Every accounting team we have briefed has adopted this rule after hearing the example, and not one has found it burdensome in practice.

Question four: how do fraud-alert emails work legitimately?

A real fraud alert typically tells you what was flagged, when, and gives you a way to respond — often an in-app confirmation rather than a link. It does not demand immediate action to "keep your account open," and it does not penalize you for verifying independently. If an email says you must act within hours through the provided link, you are looking at pressure, and pressure is the product being sold. The legitimate version of urgency exists — cards do get frozen — but it survives verification. Scam urgency dies the moment you open the bank's app and look.

Question five: why is a B2B software blog writing about this?

Because our product's integrity depends on the email channel being trustworthy. Sales teams live in their inbox; a rep who cannot spot a cloned invoice notice is one click from a compromised mailbox, and a compromised mailbox poisons every downstream system that trusts it — including tools like ours that read website activity and sync it to CRM. Phishing aimed at businesses (BEC, or business email compromise) is now among the costliest fraud categories, something the FBI's Internet Crime Complaint Center documents in its annual reports. The hygiene questions above are not consumer trivia; they are the same checks that protect a corporate tenant.

Question six: is there a reliable place to learn what real bank mail looks like?

Yes, and specificity is the point. Abstract advice ("be careful") does not train anyone; examples do. This is why we point people to the worked examples at Bank Mails' fraud-alert example library, where genuine bank emails are shown beside their phishing imitations with the tells annotated. Reading ten side-by-side comparisons trains pattern recognition faster than any checklist, in the same way reviewing real visitor sessions beats reading about visitor sessions.

The summary we give every new hire

1. The destination URL is the evidence; everything else is presentation.
2. Visual polish proves nothing; account context proves a little; independent verification proves everything.
3. No legitimate process ever requires credentials typed from an email.
4. Urgency that survives an app check is real; urgency that doesn't was phishing.

Email fraud is not clever; it is industrial. The defense is equally industrial — a small set of checks, applied every time, regardless of how busy the day is. The reps on our team who learned them stopped asking the questions, which is the outcome we wanted.

See who's on your site right now.

Reverse-IP enrichment across 41M companies — typically a 38% lift in demo conversion within 60 days.

Book a 30-min demo