Best phishing email checker to spot a scam email

The best phishing email checker is the one that checks every email before you open it, so you never have to ask "is this email a scam?" With iCloud, Gmail or Outlook, Alrighty does that on your computer: sure phishing goes to Junk, and a likely one stays with a warning that says what looks wrong. Gmail and Outlook check mail on their own servers and add warnings for free. To check one suspicious email by hand, paste it into Norton Genie, Bitdefender Scamio or Malwarebytes Scam Guard. To check only a link, use VirusTotal or urlscan.io.

Most pages for this search are short guides with a paste box. They skip two questions. First, does the tool check your mail on its own, or must you spot the scam yourself and copy it out? A checker you have to remember is no help on the email you didn't suspect. Second, where does the email you paste go? Some tools share what you send with other people. This page answers both for each tool.

How we checked

We read each vendor's own help, product and privacy pages on November 4, 2026, and every fact links to its source. Where a page didn't say something, such as how long a pasted email is kept, we say so instead of guessing. We didn't run phishing mail through the tools. Alrighty is our app, and it is listed first.

Phishing email checkers at a glance

Tool	Price	How it checks	Where the check runs	What happens to what it reads	On a Mac
Alrighty	14-day trial with no card, then Free or Pro	Every new Inbox email, on its own	Your computer	The check sends nothing to a server	Mac app, Apple silicon
Gmail	Free	Every email, on its own; Report phishing	Google's servers	A reported email's copy goes to Google	Any Mac app or the web
Outlook.com	Free with the account	Every email, on its own; Report phishing	Microsoft's servers	The sender is reported to Microsoft	Any Mac app or the web
Apple Mail and iCloud	Comes with macOS	Junk filter; forward fakes to Apple	Your Mac and iCloud	A forwarded email goes to Apple	Built in
Norton Genie	Free	You paste text or a screenshot	Norton's servers	Not stated	In a browser
Bitdefender Scamio	Free, with a Bitdefender account	You paste, upload, or send a link	Bitdefender's servers	Not stated beyond its privacy policy	In a browser
Malwarebytes Scam Guard	Free on the web; in Premium Security	You share a text, email, link or image	Malwarebytes's servers	"stored locally for 30 days"	Web, Mac app, extension
VirusTotal	Free for non-commercial use	You submit a link or a file	VirusTotal's servers	Reports "shared with the public VirusTotal community"	In a browser
urlscan.io	Free	You submit a link	urlscan's servers	Public, unlisted or private scan, your choice	In a browser

Does a phishing checker check my email on its own?

Only some do. There are two kinds, and they catch different things.

• Checks that run on every email. Gmail, Outlook.com and Alrighty judge each message as it arrives. You don't have to suspect it first. This is the kind that catches a fake invoice on a busy day.
• Checkers you paste into. Norton Genie, Scamio, Scam Guard, VirusTotal and urlscan.io wait for you. You must notice the email looks off, copy it out, and paste it in. They're useful for a second opinion, and for a text message or a web page as well as an email.

The best setup is one of each: a check on every email, and a paste-in checker for the one you're unsure about.

Where does the email I paste go?

To the checker's company, and sometimes further. Before you paste an email that holds your account numbers or a reset link, read what the tool keeps.

• VirusTotal says "Scanning reports produced by VirusTotal are shared with the public VirusTotal community," and "The contents of submitted files or pages may also be shared with premium VirusTotal customers" (VirusTotal).
• urlscan.io lets you pick. A private scan means "Nobody but you should be able to see the results of the scan." "Unlisted scans can be found by vetted security researchers and companies which are subscribers to our urlscan Pro platform" (urlscan.io).
• Malwarebytes says "Queries are stored locally for 30 days for user convenience," and "Only reported scams are added to our database" (Malwarebytes).
• Norton Genie and Scamio don't say on their product pages how long they keep what you send.
• Gmail says "When you manually move an email into your Spam folder, Google receives a copy of the email and any attachments" (Google).

Alrighty: best phishing checker inside your mail app

Alrighty is a desktop mail app for Mac, Windows and Linux that puts iCloud, Gmail and Outlook accounts in one inbox. It checks new Inbox mail for phishing on your computer, as it arrives, before you open it. You don't paste anything.

What it does. A message that is sure to be phishing goes to Junk. A likely one stays in your Inbox with a warning in the message that names the strongest sign. The signs it names include:

• a sender domain that imitates a brand or a domain you know,
• a brand's name on mail from a domain that isn't the brand's,
• a sender domain that enforces DMARC, on mail that fails it,
• link text that names one site while the link goes to another,
• an attached file that runs when you open it,
• the name of one of your contacts on mail from a free address.

No one sign moves a message. The signs add up. The check never sends mail from a sender you have written to into Junk, but it can still get a warning for a file that runs or a failed DMARC check, since a friend's account can be taken over.

Where the check runs. On your computer, against your own mail, with no server call. Your provider's own filter still runs first on its servers. Alrighty checks what gets past it.

The rest of your unwanted mail. Phishing is one kind. Clean up lists the senders you probably don't want, such as scams and cold outreach, so you can stop them all at once. Stop mail ends one sender's mail. Alrighty unsubscribes only from senders whose mail passed DMARC and wasn't marked spam, so a scammer never learns your address is live. Our spam blocker guide compares these tools.

What goes to Alrighty's server. Not the phishing check. Clean up does send each sender's address, three facts the receiving server found, and up to 3 of their newest emails (2,000 characters each) to Alrighty's server, which asks an AI model to sort them. While you're signed in, Clean up sorts senders in the background, and opening a reply starts a suggested draft.

Price. A 14-day trial with no card, then a Free plan or Pro.

What it can't do. You can't paste an email or a link into it for a verdict. It checks mail that arrives in your Inbox. There's no iPhone or web app, so the check doesn't follow you to your phone. It takes iCloud, Gmail and Outlook accounts only, not Yahoo or other IMAP. It has no calendar, and it's a new app with no long track record.

Pick it if you read mail on a computer and want every new email checked for you, with the warning in the message itself.

Gmail: best free phishing check for Gmail

Gmail checks every message on Google's servers. "Gmail is designed to help protect your account by automatically identifying phishing emails," and "When we identify that an email may be phishing or suspicious, we might show a warning or move the email to Spam" (Google).

What the warnings say. In Spam, Gmail puts "a warning at the top of each email that explains why Gmail sent it to Spam," such as "Spoofed email addresses," "Phishing scams" and "Messages from an unconfirmed sender." One warning reads "The email may be a trick to get you to share personal information, like passwords or credit card numbers" (Google).

How to report one. On a computer, open the message. Next to Reply, click More, then Report phishing. If Gmail got it wrong, choose Report not phishing.

What it can't do. It covers Gmail accounts only, and you can't paste in mail from another account.

Pick it if your mail is Gmail. It's on, and it's free.

Outlook.com: best free phishing check for Outlook accounts

Outlook checks the sender of each message on Microsoft's servers. "Outlook verifies that the sender is who they say they are and marks malicious messages as junk email. If the message is suspicious but isn't deemed malicious, the sender will be marked as unverified" (Microsoft).

What the warnings look like. "When Outlook can't verify the identity of the sender by using its email authentication techniques, it displays a '?' in the sender photo." When the real sender differs from the From address, Outlook shows the real one with a "via" tag.

How to report one. Select the message. "Above the reading pane, select Report > Report phishing to report the message sender." Microsoft notes that the sender "is reported but is not blocked from sending you additional messages." To block them too, use our block a sender guide.

What it can't do. It covers Microsoft accounts only. Hovering over a sender in the message list to see the address "is only available if you sign in with a work or school account."

Pick it if you use Outlook.com, Hotmail or Microsoft 365.

Apple Mail and iCloud: best for reporting fake Apple emails

Apple Mail has a junk filter. Choose Mail, Settings, click Junk Mail, then check that Enable junk mail filtering is selected. "Each time you confirm a message as junk or not junk, the junk mail filter improves" (Apple).

How to report one. "If you receive a suspicious email that looks like it's supposed to be from Apple, please forward it to reportphishing@apple.com." From Mail on a Mac, select the message and choose Forward As Attachment from the Message menu, so Apple gets the headers. For spam in an iCloud inbox, "mark the spam emails as Junk or move them to your iCloud Junk folder" (Apple).

What it can't do. Apple's Mail guide doesn't describe a phishing warning in the message. Safari warns when you open a "suspected phishing website" (Apple), so the warning comes after you click the link.

Pick it if you use Apple Mail and want to report fake Apple messages to Apple.

Norton Genie: best free checker for a screenshot

Norton Genie is an AI scam checker. "Simply copy and paste or upload a screenshot of the text message, social media post, email, or website you want to be checked into Genie." It's free at Genie.Norton.com or as a phone app (Norton).

On a Mac. There's no Mac app for Genie. Use the web version in Safari, Chrome, Edge or Firefox. The phone apps need iOS 15 or Android 8 and later.

What happens to what you send. The FAQ says Norton's library of known scams is "used to train Genie." It doesn't say whether your own submissions are kept.

Automatic version. Norton's paid Safe Email "helps to protect up to five of your email addresses against phishing emails and malicious attachments. Working in the cloud, it flags emails as safe or potentially suspicious before you open them" (Norton). It works with Gmail, Outlook.com and Yahoo, among other providers. That means Norton's servers check your mail.

Pick it if you have a screenshot of a suspicious message and want a quick second opinion.

Bitdefender Scamio: best for checking from a chat app

Scamio is Bitdefender's "Free Scam Detector." "Send any tricky text, email, social media message, link, or even QR code you received to get an instant analysis." "You can either copy-paste the message, upload an image, send a link, or describe your situation."

Where it works. It's "Available on web, WhatsApp, Messenger, and Discord." To use it, you "sign in or create a Bitdefender account."

How it judges. "The content is compared against a set of predefined rules and Bitdefender's huge database of known scams and phishing attempts."

What it can't do. It checks only what you send it. Its page says it uses your data "in accordance with our Privacy Policy," and doesn't say how long it keeps a message.

Pick it if you want to forward a suspicious message to a checker in WhatsApp or Messenger.

Malwarebytes Scam Guard: best checker with a Mac app

Scam Guard checks what you "Share a number, text, email, URL, or image." You can try it on the web for free. It's also "available in Malwarebytes Premium Security for Windows, Mac, iOS, Android, and in Browser Guard," Malwarebytes's browser extension.

What happens to what you send. "Queries are stored locally for 30 days for user convenience. Malwarebytes maintains a strict zero-logging policy." That is the clearest data statement of the paste-in checkers on this page.

What it can't do. Malwarebytes says "New scams emerge daily, so not every threat may be caught immediately." It checks what you share. It doesn't read your inbox.

Pick it if you want a scam checker on the web, on your Mac and in your browser from one company.

VirusTotal: best for checking a link or an attachment

VirusTotal checks a link or a file, not the email around it. "VirusTotal inspects items with over 70 antivirus scanners and URL/domain blocklisting services." It "is free to end users for non-commercial use."

What happens to what you send. Reports are "shared with the public VirusTotal community," and the contents "may also be shared with premium VirusTotal customers." Never upload an attachment that holds your own private data.

Pick it if an email has a link or a file you want checked against many scanners at once.

urlscan.io: best for seeing where a link really goes

urlscan.io "is a free service to scan and analyze websites." "We browse to a URL like a regular user and record everything that the page navigation creates," so you see the page without opening it yourself. You choose whether a scan is public, unlisted or private (FAQ).

What it can't do. It checks web pages, not the email. Use a private scan for a link that might carry your address or an account token.

Pick it if you want to see a link's real page without opening it.

Where should I report a phishing email?

Report it to your mail provider first, with its Report phishing button, so its filter learns. Then, if you want:

• In the UK, forward it to report@phishing.gov.uk. The National Cyber Security Centre says "Forward us as many suspicious emails as you like," and "It's free to report a suspicious email to us" (NCSC).
• A fake Apple email, forward it to reportphishing@apple.com, as above.
• In the US, the FTC's guide to phishing scams says to forward phishing email to the Anti-Phishing Working Group and report it at ReportFraud.ftc.gov.

To stop the scams that keep coming, see our guide to stopping spam emails.

How to choose

• Every new email checked on your computer, with the warning in the message: Alrighty.
• All Gmail, free: Gmail's own warnings and Report phishing.
• Outlook.com or Microsoft 365, free: Outlook's sender checks and Report phishing.
• A fake Apple email in Apple Mail: forward it to Apple.
• A screenshot of a suspicious message: Norton Genie.
• Check from WhatsApp or Messenger: Bitdefender Scamio.
• A checker on the web and your Mac, with a clear data policy: Malwarebytes Scam Guard.
• One link or attachment, many scanners: VirusTotal.
• See a link's page without opening it: urlscan.io.

Questions

How can I tell if an email is a phishing scam?

Look at the sender's full address, not the name, and check that the domain is really the company's. Hover over a link and compare where it goes with what it says. Be wary of urgency, a request for a password or payment, and an attachment you didn't expect. A checker helps, but the provider's own warning is often the first sign.

Is it safe to paste a suspicious email into a checker?

Usually, but check what the tool keeps first. VirusTotal shares reports with its community, and Norton Genie and Scamio don't say how long they keep what you send. Remove your own account numbers and reset links before you paste.

Does Apple Mail warn about phishing emails?

Apple's Mail guide describes a junk filter, not a phishing warning in the message. Safari warns when you open a suspected phishing site. iCloud also filters junk on its servers before mail reaches Apple Mail.

What should I do if I clicked a link in a phishing email?

Close the page, and don't enter anything more. If you typed a password, change it at once on the real site, and turn on two-factor sign-in. If you entered card details, call your bank. Then report the email with your provider's Report phishing button.

Does reporting phishing block the sender?

Not always. Microsoft says a sender you report as phishing "is reported but is not blocked from sending you additional messages." Block the address as well, or use a tool that keeps their mail out.