Is This Email a Scam? Ask AI in 2 Minutes

An email says your bank spotted fraud, your Norton or Geek Squad plan just renewed for $400, or a package can't be delivered. Before you click, call, or reply, let a free AI tool take a second look.

New to AI? Start with AI Basics in Plain English.

Why it matters: in 2025, Americans aged 60 and over reported more than $7.7 billion in losses to the FBI's Internet Crime Complaint Center. Phishing and spoofing (fake messages pretending to be someone you trust) drew more complaints from older victims than any other type of scam: more than 48,000 (FBI). The FTC says email was the top way scammers reached people in 2024 (FTC).

The old advice was to look for bad spelling. That doesn't work as well anymore. The government's cybersecurity agency notes that, with AI, some scam emails now have perfect grammar and spelling (CISA). The good news: AI can help you check them, too.

What you need

• A free AI app or website: ChatGPT, Google Gemini, Microsoft Copilot, or Claude all work
• The suspicious email, still sitting in your inbox (don't click anything in it)

Quick red flags

• Hurry or fear: "Your account will be closed in 24 hours." "A warrant has been issued."
• A charge you don't recognize, with a phone number to call "to cancel." Fake Geek Squad, Norton, McAfee, and PayPal renewals work this way (FTC).
• A sender address that doesn't match the company, like a Gmail address for "PayPal Billing," or a look-alike such as amaz0n-support.com.
• A link or button to "verify," "update payment," or "track your package."
• "Reply with your information": your password, account number, Social Security or Medicare number, or a code that was texted to you.
• An attachment you weren't expecting, such as an "invoice" or "shipping label."
• Someone you know asking for an odd favor, like your boss, pastor, or grandchild needing gift cards or a wire transfer, and asking you to keep it quiet.
• A government agency asking for money or personal details by email. The IRS says it never emails you without your permission (IRS).

Step by step

1. Don't click, don't reply, don't open attachments. Leave every link, button, and phone number in the email alone for now.
2. Find the real sender address. The name you see ("Wells Fargo Security") can say anything. The address behind it is harder to fake.
   • On a phone: open the email and tap the sender's name at the top. The full email address appears.
   • On a computer: rest your mouse pointer on the sender's name, or click it once. The full address appears.
3. Check where a link really goes (optional).
   • On a computer: rest your mouse pointer on the link without clicking. The real web address shows in a small box or in the bottom corner of the window. To copy it, right-click the link and choose "Copy link" or "Copy link address." That copies it without opening it.
   • On a phone: be careful here. Pressing and holding a link shows its address, but on some phones it also opens a small preview of the website. If a preview pops up, don't tap it. When in doubt, skip the link. AI can still judge the email from its words and the sender address.
4. Remove anything private. Before you paste, delete account numbers, your Social Security or Medicare number, your home address, and any passwords or codes. Type [removed] in their place.
5. Copy the email's words, or take a screenshot. On most phones, press the side button and volume-up together. Crop out anything private.
6. Open your AI app and paste this:

   I'm over 60 and got this email. Is it likely a scam (phishing)? Please:
   1. List the warning signs in plain English.
   2. Tell me if the sender address or link look fake or don't match the real company. Do not open or visit the link; just look at the address.
   3. Tell me what I should do next, and how to contact the real company safely without using any link, phone number, or reply from this email.
   
   Sender address: [paste the sender's email address]
   Link address (if I copied it): [paste it here, or write "none"]
   Email text:
   [paste the email here, or attach the screenshot]

7. Read the warning signs. If AI says it looks like a scam, you're done: report it and delete it (see below). If AI says it looks real, still check for yourself in the next step.
8. Check for yourself. Open the company's own app, or type its web address yourself. Or call the number on the back of your card or on a statement you already have. Never use a number or link from the email.

Bonus prompt: a "fraud alert" from your bank

Fake fraud alerts are scary on purpose. They want you to act before you think. Paste the alert into AI with this:

I got this email that says it's a fraud alert from my bank. Explain in plain English what it's asking me to do. Does it match how a real bank fraud alert usually works, or does it look like a scam? Point out anything a real bank wouldn't ask for. Then tell me the safest way to check my account without using anything in this email.

Sender address: [paste it]
Email text: [paste it, with account numbers removed]

Real banks do send fraud alerts. But you never need the email to check. Open your bank's app or call the number on the back of your card, and ask if there's really a problem.

Bonus prompt: an email from someone you know

Scammers sometimes pretend to be your boss, your pastor, a friend, or a grandchild. They may even use a real name you know.

I got an email that seems to be from [my pastor / my boss / my grandson / a friend]. It asks me to [buy gift cards / send money / click a link / keep this private]. What are the signs this could be someone pretending to be them? Give me a short, polite message I can send to the real person, using the phone number I already have, to check.

Email text: [paste it]

Then call or text the person at the number you already have. Don't reply to the email.

Already clicked? Here's what to do

It happens to careful, smart people every day. Acting quickly helps. These steps come from the FTC's guides on phishing and what to do if you were scammed:

• You clicked a link or opened an attachment: update your security software, then run a scan and remove anything it finds.
• You typed a password: change it right away on the company's real website or app. If you use that password anywhere else, change it there, too. Turn on two-step sign-in (two-factor authentication).
• You gave a card or bank number, or paid: call your bank or card company now, using the number on the back of your card. Ask them to stop or reverse the payment.
• You gave your Social Security number: go to IdentityTheft.gov for a step-by-step recovery plan.
• You let someone into your computer: update your security software, run a scan, and change your passwords.

AI can help you stay calm and organized:

I think I fell for a scam email. Here's what happened: [describe it, without account numbers or passwords]. Make me a calm, short checklist of what to do in the next hour, in order. Include who to call, but tell me to look up their phone numbers myself on my card or their official website.

Want to talk to a person? The AARP Fraud Watch Network Helpline is free for anyone, at 877-908-3360.

Report it, then delete it

• Forward the email to the Anti-Phishing Working Group at reportphishing@apwg.org.
• Tell the FTC at ReportFraud.ftc.gov.
• If you lost money, call your bank first, then file a report with the FBI at ic3.gov.
• Fake IRS emails: forward them to phishing@irs.gov (IRS instructions).
• Fake Social Security or Medicare emails: see Social Security's scam awareness page, or call 1-800-MEDICARE (Medicare.gov).
• Fake company emails: many companies list a place to report fake emails on their own website. Look it up yourself; don't use the email.
• Use your email's "Report spam" or "Report phishing" button, then delete the email.