Scam library · Email & phishing · Small business · Banking & payment apps
Lookalike domain email scam
The sender name and logo look right, and the email address is close: 'billing@arnazon.com', 'support@paypa1.com' or 'accounts@yourvendor-inc.com' instead of 'yourvendor.com'.
These lookalike domains are cheap to register and are used for phishing and payment fraud. A quick glance won't catch them, especially on a phone.
What the message looks like
From: Accounts Payable <ap@acme-suppIy.com> (capital I instead of l)
Subject: Updated remittance details
Hello, please note our bank details have changed effective immediately.
Please use the attached instructions for this week's payment of invoice #2231.
How this scam works
Common tricks include swapping letters that look alike (rn and m, l and 1, 0 and o), adding words like 'secure' or 'support', or using a different ending such as .co instead of .com. Some use characters from other alphabets that look identical.
In business email compromise, scammers register a domain one letter off from a real vendor or client, then reply into a real conversation with new bank details. The FBI reported $3.05 billion in business email compromise losses in 2025.
Phone screens often show only the sender's name, not the full address. Tap or hover to see it.
A good habit is to save the real addresses of your bank, key vendors and clients in your contacts. When an email arrives that doesn't match a saved contact, that's a cue to slow down. For businesses, your IT provider can also register common misspellings of your own domain and set up email authentication so others can't easily spoof you.
Links can use the same tricks, so check where a link really goes before signing in. Typing the site's address yourself avoids the problem altogether.
Red flags
- A sender address that's almost, but not exactly, the usual one.
- Extra words in the domain, like 'secure', 'billing' or 'support'.
- Different domain endings, like .co, .net or .info.
- A reply in an existing thread from a slightly different address.
- Changed bank details or urgent payment requests.
How to tell it’s fake
- Expand the sender details and compare the address letter by letter with an older email.
- Call the person using a number you already have before acting on payment changes.
- Use email security features like external sender warnings.
What to do if you clicked, paid or shared info
Don’t panic, and don’t blame yourself. These scams are built by professionals. Act quickly, one step at a time.
If you clicked a link or called back
- If you clicked a link, close it and don't sign in. Report the email to your IT team or email provider.
If you paid
- If you sent a payment, call your bank right away to recall it and report it to ic3.gov.
If you shared personal info, a password or a code
- If you entered a password, change it and enable multi-factor authentication.
Where to report and get help (U.S.)
If a message seems legit and you’re still not sure, get a second opinion before you act. Reporting helps stop scammers, even if money can’t be recovered. If you are in danger, call 911.
- Your bank or card issuer
Call the number on the back of your card or on your statement, not one from the message. Ask them to stop or reverse the payment and to watch the account. - Federal Trade Commission (FTC) · ReportFraud.ftc.gov
Report the scam and get a step-by-step recovery plan. - FBI Internet Crime Complaint Center (IC3) · ic3.gov
Report scams that happened online, especially if money was lost. Include phone numbers, websites and payment details. - AARP Fraud Watch Network Helpline · aarp.org helpline
Free, for anyone of any age: trained volunteers help you sort out next steps. 877-908-3360, Monday to Friday, 8 a.m. to 8 p.m. Eastern. - IdentityTheft.gov · IdentityTheft.gov
If you shared your Social Security number or someone opened accounts in your name.
How Gmork Scam Guard would warn you
Scam Guard runs in Chrome and Edge on your computer and looks closely at senders in Gmail or Outlook on the web. It catches lookalike domains a tired eye misses and explains exactly which letters differ, before you click or pay. When an email seems legit, a careful second look is what Scam Guard is for.
Scam Guard can miss things, so the checks above still matter. See what it warns about and what it keeps private.
Questions people ask
- How do I see the real sender address?
- On a computer, hover over or click the sender's name. On a phone, tap the name to expand details.
- Can a domain look identical but be different?
- Yes. Some use characters from other alphabets. That's why calling to verify payment changes matters.
- Does my email provider catch these?
- Some, but not all. Lookalike domains can pass basic checks.