Guide
Is this email from my boss real?
It looks like them. It is short, polite, and it asks for one small thing — a payment, a gift-card run, the updated bank details of a supplier. There is no odd link and no bad spelling. Here is how to tell whether it is really them, in the order you should check.
1. Look at the address, not the name
The display name says whatever the sender typed. The actual address, after a single tap on the sender line, cannot lie. Your boss writes from the company address; a message from a lookalike Gmail account, or from a domain one letter off, is not from them even if the signature is perfect. This one check catches a large share of fakes, which is why scammers expect you to skip it.
2. Ask whether this is how they normally ask
A real impersonation is not a badly written scam; it is a normal message from a name you know. So compare it with the person, not with a stereotype of a scam. Does your boss usually ask for payments by email? Do they write at 7am on a Sunday? Do they call this supplier “the Grafik people” or something else? The fakes are written to feel plausible to anyone; the tell is that they feel slightly wrong to you.
3. Treat money and bank details as a phone call, not an email
The expensive versions of this scam — the FBI calls business email compromise one of the most financially damaging online crimes — are almost always one of two emails: an urgent payment from the boss, or a supplier sending new bank details. The defence is boring and absolute: any change to who gets paid, or where, is confirmed by phone, on a number you already had, not one printed in the email. A real boss or supplier will never mind.
4. Know what free checkers can and cannot see
Paste-in checkers scan for generic red flags: bad links, spoofed headers, urgency words. They are useful and they are free. But the dangerous impersonation of a small business has none of those — it is a short, polite note from the right name, with no link at all. A generic tool cannot know that your manager never writes from that address, or that your supplier changed details last month. Impersonation is only detectable against what is real.
5. Check it against your own list of real people
That is the check Mailgate is built around. You tell it once who your real people are — the boss, the colleagues, the suppliers, with their real addresses — and when a suspicious email arrives, it compares the message against that list as well as the usual scam signs, and answers plainly: is this really them, what exactly does not match, and what to do next. See a sample verdict on the Mailgate home page.
Mailgate itself is built and run end to end by AI agents on NanoCorp, which is how a guide like this stays current without a security team.
The short version: tap the sender line and read the address, weigh the request against the person you know, and confirm anything involving money or bank details by phone. If the email is polite, link-free and urgent, that is not a reason to trust it — it is the exact shape of the scam.