Suspicious business emails and messages are difficult because many of them are designed to look routine. A payment request may appear to come from a vendor. A message may imitate an executive. A link may look like a familiar login page. The danger often comes from acting before verifying who actually sent the message and whether the request makes sense.
This checklist can help small businesses, employees, contractors, and business owners review a suspicious message before replying, clicking, sharing information, or sending money.
1. Check the sender address carefully
Do not rely only on the display name. Open the full sender address and compare the domain with the organization the sender claims to represent.
Watch for misspellings, extra words, unexpected free email accounts, unusual subdomains, or small character changes that can be easy to miss at a glance.
2. Ask whether the request is normal
A message can come from a real-looking address and still be suspicious. Consider whether the request fits your normal relationship with the sender.
Be cautious with sudden requests for payment, gift cards, login credentials, tax information, payroll changes, bank account changes, confidential files, or urgent exceptions to normal procedures.
3. Verify urgent requests using a trusted channel
If the message asks you to act quickly, verify it through a contact method you already trust. Call a known phone number, use an existing business portal, or contact the person through a previously established channel.
Do not use only the phone number or contact information contained in the suspicious message itself.
4. Inspect links before clicking
Look at the actual destination of a link before opening it. The visible text can say one thing while the destination points somewhere else.
Pay attention to unusual domains, misspelled brand names, shortened links, or login pages hosted on unrelated websites.
5. Review attachments cautiously
Unexpected invoices, ZIP files, spreadsheets, PDFs, and shared-document notifications can be used to deliver malicious files or redirect you to fake sign-in pages.
If the attachment or document is unexpected, confirm the request before opening it.
6. Be careful with payment changes
One of the highest-risk situations is a message announcing new payment instructions. This can happen during vendor relationships, real estate transactions, payroll processes, and business purchases.
Any last-minute bank change should be verified independently before money is sent.
7. Look for inconsistencies in tone and context
Ask whether the language, timing, signature, request, and level of urgency are consistent with the person or business you know.
Unusual wording, unexplained urgency, secrecy requests, or pressure to bypass normal approval steps can be useful warning signs.
8. Check claims independently
If the message refers to an invoice, contract, account problem, delivery, legal notice, security alert, or government request, verify the claim using the original organization or a trusted official source.
Do not assume that a logo, signature block, or branded page proves authenticity.
9. Preserve the evidence
Keep the original message, sender information, screenshots, links, invoice details, and any follow-up communication. This can help with internal review, incident response, or reporting if the message turns out to be fraudulent.
10. Stop when the identity is not clear
You do not need to prove that a message is fraudulent before deciding not to act. If the sender identity, payment instructions, or purpose of the message cannot be verified, delay the action until the uncertainty is resolved.
Use Tolux Verify to review a suspicious message
Tolux Verify is designed to review messages, screenshots, URLs, businesses, vendors, contractors, claims, and other supported evidence using source-backed analysis, citations, risk indicators, and unresolved questions.
You can use Tolux Verify to organize what is known, what can be supported, and what still needs independent confirmation before you respond or act.
For payment-related situations, also read How to Verify a Business Before Sending Money.
Run a message or screenshot verification with Tolux Verify before responding to a suspicious business communication.
Tolux Verify provides decision support based on available evidence. It does not guarantee that a message, sender, link, or transaction is legitimate or safe. For urgent security incidents or suspected fraud, follow appropriate internal procedures and contact qualified professionals or relevant institutions.