The checker reads one suspicious email. Batmail reads your whole inbox overnight.
Paste the AT&T email into the checker and it reads it for the signs below.
The checker reads the sender address, the wording, any link address you paste with the email and what the email asks you to do. It gives a verdict, a risk score from 0 to 100, the exact wording behind each red flag and what to do next. It is free and needs no signup.
Batmail phishing email checker
A fake AT&T email says your bill is past due, then sends a zip file to open.
AT&T’s page on fake emails lists the signs: odd claims about your bill, a request for personal or account information, a high balance with a threat to suspend your account, no account number, links to sites that are not AT&T’s, and attachments. The email below is invented, and each number is one of them.
Example
Dear customer,
Your AT&T balance of $842.17 is past due, and your service will be suspended today.
Open the attached file ATT_Payment_0000.zip to see your bill.
Pay now through the sign-in link below to avoid a late fee.
The button says att.com/pay
The sender's address is not att-mail.com.
AT&T says all its emails are sent from att-mail.com, so if you don't see that address, it didn't send the email.
No account number anywhere in the email.
AT&T says that when it emails you about your bill, it includes either several digits or your full account number.
A high balance and a threat to suspend service.
AT&T lists a high balance with a threat to suspend your account as a sign. It also says it never uses all capital letters in its subject lines, and this subject does.
A zip file named ATT_Payment.
AT&T says its bills don't include attachments, and that fake attachments will be in .zip format and may have names that start with ATT_Payment.
A sign-in button that goes somewhere else.
AT&T lists links to non-AT&T websites as a sign, and says to hover over the links to see the true destination.
From AT&T Support: Identify Fake AT&T Emails, read 7 November 2026.
From AT&T Support: Protect Yourself from Phishing and Fake Websites, read 7 November 2026.
Read the sender's address from the right, because the last two parts say who owns it.
Anyone can put “AT&T” in front of an address. The part to read is the domain, after the @ in a sender or after the https:// in a link. Read it from the right: the last two parts name the owner, and everything in front of them is only a label the owner chose. AT&T’s support pages are at www.att.com, but it says its emails are sent from att-mail.com, a different domain, so the two are listed separately below.
Read the domain from the right
att-mail.com
From AT&TOwned by att-mail.com. AT&T says all its emails are sent from att-mail.com.
www.att.com
From AT&TOwned by att.com. This is the address of AT&T's own support pages, where it explains the signs of a fake email.
att.com.bill-pay.example
Not from AT&TOwned by bill-pay.example. att.com is only a label in front of it.
att-account-center.example
Not from AT&TOwned by att-account-center.example. The name has AT&T in it, but the owner is someone else.
From AT&T Support: Protect Yourself from Phishing and Fake Websites, read 7 November 2026.
AT&T says its emails come from att-mail.com, its bills carry no attachments and its subjects never use all capitals.
AT&T’s two pages on phishing give short rules for the emails that use its name. A fake bill breaks at least one of them.
| Question | What AT&T says | What a fake AT&T email does |
|---|---|---|
| Where do real emails come from? | What AT&T says"All AT&T emails are sent from att-mail.com." | What a fake AT&T email doesComes from another domain, often with AT&T in its name. |
| Does a bill email show your account number? | What AT&T saysWhen AT&T emails you about your bill, it says it will include either several digits or your full account number. | What a fake AT&T email doesHas no account number at all. |
| Does a bill come with an attachment? | What AT&T saysAT&T says its bills don't include attachments. Fake attachments are .zip files and may have names that start with ATT_Payment. | What a fake AT&T email doesA .zip file named ATT_Payment. |
| How does AT&T write subjects and address you? | What AT&T saysAT&T says it never uses all capital letters in its subject lines, and that your email is only sent to you. | What a fake AT&T email doesA subject in capitals, or an email copied to other recipients. |
From AT&T Support: Identify Fake AT&T Emails, read 7 November 2026.
From AT&T Support: Protect Yourself from Phishing and Fake Websites, read 7 November 2026.
AT&T takes fake emails at abuse@att.net and fake texts at 7726.
AT&T’s page on reporting fraud covers email, text and phone fraud. It does not list an address or a short code for phone calls. It describes fake emails as including phishing and fake emails from AT&T, and fake texts as including SmiShing, rewards scams and spam.
Where AT&T says to send a fake message
- A fake email
Forward it to abuse@att.net.
AT&T says to include the full email header when possible, then to delete the email.
- A fake text
Forward it to 7726 (SPAM).
AT&T says this is free for AT&T customers. It also lists reportphishing@apwg.org.
- No number shown
Email the whole message to abuse@att.net.
AT&T says to do this when you can't see the sender's number.
From AT&T Support: Report Text, Email, or Phone Fraud, read 7 November 2026.
Five steps tell you whether an AT&T email is real without clicking anything.
- Do not open it, click any links or open any attachments. That is AT&T’s first step for a suspicious email.
- Read the sender’s address from the right, as in the picture above. Then look for an account number, and for an attachment: AT&T says its bills have none.
- Hover over any link to see the true destination, as AT&T says, and share nothing if you are not sure the site is AT&T’s. To look at your bill, open AT&T’s site or app yourself.
- Paste the email into the checker at the top of this page for a second read.
- Forward the email to
abuse@att.net, with the full header when possible, then delete it. A suspicious text goes to7726. In Gmail you can also choose More next to Reply, then Report phishing.
Steps from AT&T Support: Identify Fake AT&T Emails, read 7 November 2026.
Steps from Gmail Help: Avoid & report phishing emails, read 7 November 2026.
If you opened the zip file or clicked, the FTC says to update your security software and scan.
AT&T’s phishing page has no section on what to do after you clicked. Its closest advice is to monitor bank and credit card statements for suspicious charges or transfers. The FTC says that if something may have downloaded, you should update your computer’s security software, run a scan and remove anything it finds. For details you shared, IdentityTheft.gov lists the steps that match what you lost.
What to do depends on what you did
You only read it.
Forward it to abuse@att.net and then delete it.
You clicked, or opened the zip file.
Update your computer's security software, run a scan and remove anything it identifies as a problem.
You entered account, card or identity details.
Follow the steps at IdentityTheft.gov for what you shared. Watch your bank and card statements for charges or transfers you did not make.
From AT&T Support: Protect Yourself from Phishing and Fake Websites, read 7 November 2026.
From FTC Consumer Advice: What To Do if You Were Scammed, read 7 November 2026.
From FTC Consumer Advice: How To Recognize and Avoid Phishing Scams, read 7 November 2026.
The same checks work on other bill and account emails.
A past-due bill can borrow the name of any provider or store. The guide to fake Costco emails covers a failed membership payment, and the guide to fake Geek Squad emails covers a renewal invoice with a number to call. The holiday scam emails guide puts the kinds side by side.
These are the questions people ask next.
How can I tell a real AT&T email from a fake one?
AT&T says all its emails are sent from att-mail.com, so if you do not see that address, it did not send the email. It says that when it emails you about your bill, it includes either several digits or your full account number, and that it never uses all capital letters in its subject lines.
Do AT&T bills come with attachments?
No. AT&T says its bills do not include attachments, and that fake attachments will be in .zip format and may have names that start with ATT_Payment. Its first step for a suspicious email is not to open it, click any links or open any attachments.
What are the warning signs of a fake AT&T email?
AT&T says a fake email may make odd claims about your bill, ask for personal or account information, claim a high balance is due and threaten to suspend your account, leave out your account number, link to sites that are not AT&T's, or include attachments. It says to hover over links to see the true destination.
Where do I report a fake AT&T email?
AT&T says to forward the email to abuse@att.net, with the full email header when possible, and then delete it. If you use a currently.com address, it says to select the Spam button in the toolbar above the message. In Gmail you can also open the message, choose More next to Reply, then Report phishing.
Where do I report a fake AT&T text?
AT&T says to forward a suspicious text to 7726 (SPAM), which is free for AT&T customers, and to the Anti-Phishing Working Group at reportphishing@apwg.org. If you cannot see the sender's number, it says to email the entire message to abuse@att.net.
What should I do if I opened the attachment or clicked a link?
The FTC says to update your computer's security software, run a scan and remove anything it identifies as a problem. For details you shared, IdentityTheft.gov lists the steps that match what you lost, and AT&T suggests monitoring bank and credit card statements for suspicious charges or transfers.
Every step on this page comes from these official pages.
Read on . Spot a step that has changed? Email support@batmail.ai and we will fix it.
- AT&T Support: Identify Fake AT&T Emails
- AT&T Support: Report Text, Email, or Phone Fraud
- AT&T Support: Protect Yourself from Phishing and Fake Websites
- FTC Consumer Advice: What To Do if You Were Scammed
- FTC Consumer Advice: How To Recognize and Avoid Phishing Scams
- IdentityTheft.gov
- Gmail Help: Avoid & report phishing emails