The checker reads one suspicious email. Batmail reads your whole inbox overnight.
Paste the Citi email into the checker and it reads it for the signs below.
The checker reads the sender address, the wording, any link address you paste with the email and what the email asks you to do. It gives a verdict, a risk score from 0 to 100, the exact wording behind each red flag and what to do next. It is free and needs no signup.
Batmail phishing email checker
A fake Citi email threatens to suspend your account unless you confirm your banking login.
Citi’s page on financial scams says scam emails can look very convincing, and lists the signs to check. The email below is invented, and each number is one of them.
Example
Hello,
Their is a problem with you're account.
Act now or your account will be suspended and your money frozen.
Confirm your online banking user ID and password with the link below.
The button says citi.com/confirm
The sender's address is not at citi.com.
The display name says Citi, but the part after the @ belongs to someone else. Citi says just because the "from" name looks legitimate doesn't mean it is, and to check the actual email address.
Typos and poor sentence structure.
Citi says emails filled with typos, spelling mistakes or poor sentence structure are probably fake.
A threatening tone that tells you to act now.
Citi says urgent or threatening tones are a major red flag, because scammers want you to panic and not think.
A request for your banking login.
Citi says you may get calls, texts or emails asking for your banking credentials, and that the scammer's goal is to get you to give confidential information to a source you believe is trusted.
A button that says citi.com and goes somewhere else.
Citi says you can hover your mouse over links without clicking to see where they truly lead, and that if the destination is clearly different than what is displayed, you should not click.
From Citi: Financial scams to watch out for, read 8 November 2026.
Read the sender's address from the right, because the last two parts say who owns it.
Anyone can put “Citi” in front of an address. The part to read is the domain, after the @ in a sender or after the https:// in a link. Read it from the right: the last two parts name the owner, and everything in front of them is only a label the owner chose. Citi’s own page on financial scams is at www.citi.com, and the owner of that address is citi.com. Citi says to check the actual email address to see if it is misspelled or uses a public domain rather than a company address. The page does not list the addresses Citi sends from, so a lookalike is a reason to stop.
Read the domain from the right
www.citi.com
From CitiOwned by citi.com. This is the address of Citi's own page on financial scams.
citi.com.account-confirm.example
Not from CitiOwned by account-confirm.example. citi.com is only a label in front of it.
citi-account-review.example
Not from CitiOwned by citi-account-review.example. The name has Citi in it, but the owner is someone else.
From Citi: Financial scams to watch out for, read 8 November 2026.
Citi says a legitimate-looking name does not make an email legitimate.
Citi’s page on financial scams gives a short list of things to check in an email. A fake account alert fails most of them.
| Question | What Citi says | What a fake account alert does |
|---|---|---|
| Does the sender's name prove it is Citi? | What Citi saysCiti says just because the "from" name looks legitimate doesn't mean it is, and to check the actual email address for a misspelling or a public domain rather than a company address. | What a fake account alert doesA display name that says Citi over an address at an unrelated domain. |
| Is the tone urgent or threatening? | What Citi saysCiti says urgent or threatening tones are a major red flag, because scammers want you to panic and not think. | What a fake account alert doesSays your account will be suspended unless you act now. |
| Where does the link go? | What Citi saysCiti says to hover over a link without clicking to see where it truly leads, and not to click if the destination is clearly different than what is displayed. | What a fake account alert doesA button that says citi.com and opens another site. |
| Are there typos? | What Citi saysCiti says emails filled with typos, spelling mistakes or poor sentence structure are probably fake. | What a fake account alert doesMixes up words such as their and there, or your and you're. |
| Can I open the attachment? | What Citi saysCiti says never to click a link or attachment in an email without verifying it is legitimate. | What a fake account alert doesA link or file you were not expecting. |
From Citi: Financial scams to watch out for, read 8 November 2026.
Citi says to check the address and hover over the link before you click anything.
The Citi page we read does not name a number to call. It gives three checks to make on the email itself, and a fourth rule: never click a link or attachment without verifying it is legitimate.
What Citi says to check in an email before you click
- Read the address
The actual address, not the name.
Citi says a legitimate-looking "from" name does not mean the email is legitimate.
- Hover over the link
Do not click it.
Citi says you can hover your mouse over links without clicking to see where they truly lead.
- Stop if they differ
A different destination means no click.
Citi says if the destination is clearly different than what is displayed, don't click.
From Citi: Financial scams to watch out for, read 8 November 2026.
Five steps tell you whether a Citi email is real without clicking anything.
- Leave the button, every link and every attachment alone. Citi says never to click a link or attachment in an email without verifying it is legitimate.
- Read the sender’s actual address from the right, as in the picture above. Citi says the display name alone proves nothing, and that a public domain instead of a company address is a sign.
- On a computer, hover over the link to see where it goes. Citi says that if the destination is clearly different than what is displayed, you should not click. The FTC says to contact a company using a phone number or website you know is real, not the information in the email.
- Paste the email into the checker at the top of this page for a second read.
- Report it. Citi’s page names the FTC, your local police and the FBI’s Internet Crime Complaint Center for scams. The FTC says to forward a phishing email to reportphishing@apwg.org. In Gmail you can also choose More next to Reply, then Report phishing.
Steps from Citi: Financial scams to watch out for, read 8 November 2026.
Steps from FTC Consumer Advice: How To Recognize and Avoid Phishing Scams, read 8 November 2026.
Steps from Gmail Help: Avoid & report phishing emails, read 8 November 2026.
If you clicked or shared your login, Citi says to contact your bank and change your passwords.
Citi’s page has no steps for people who replied to or clicked on a scam message. Its general advice for anyone targeted or compromised is to contact your bank or credit card issuer, to change your account passwords, and to update your security software and scan your computer. It says your financial institution can help you understand your options, and that if you lost money you may ask it to reverse fraudulent charges.
What to do depends on what you did
You only read it.
Do not click anything. Report it to the FTC at ReportFraud.ftc.gov.
You clicked, or shared your login.
Contact your bank or credit card issuer, and change your account passwords. Update your security software and scan your computer.
You gave account details, or lost money.
Ask your financial institution about reversing fraudulent charges, then follow the steps at IdentityTheft.gov for what you shared.
From Citi: Financial scams to watch out for, read 8 November 2026.
From FTC Consumer Advice: What To Do if You Were Scammed, read 8 November 2026.
From FTC Consumer Advice: How To Recognize and Avoid Phishing Scams, read 8 November 2026.
The same checks work on other bank and card emails.
An account alert can borrow the name of any bank. The guide to fake Chase emails covers a fraud alert that tells you to move your money, the guide to fake Capital One emails covers a payment update that opens with Sir or Madam, and the guide to fake Bank of America emails covers an email that tells you not to call. The holiday scam emails guide puts the kinds side by side.
These are the questions people ask next.
How can I tell a real Citi email from a fake one?
Citi says urgent or threatening tones are a major red flag, because scammers want you to panic and not think. It says a legitimate-looking "from" name does not mean the email is legitimate, so check the actual email address, and that emails filled with typos, spelling mistakes or poor sentence structure are probably fake.
What does Citi say to do with links in an email?
Citi says you can hover your mouse over links without clicking to see where they truly lead, and that if the destination is clearly different than what is displayed, you should not click. It says never to click a link or attachment in an email without verifying it is legitimate.
Does Citi list the addresses it sends from?
The Citi page we read does not list them, and it does not say what Citi will never ask for. It does say to check the actual email address for misspellings, or for a public domain rather than a company address.
What do scam emails ask for?
Citi says you may get calls, texts or emails asking for your banking credentials and other personal data, and that the scammer's goal is to get you to give confidential information to a source you believe is trusted.
Where do I report a scam email?
Citi says you can report suspected financial scams to your local police or sheriff's office and the Federal Trade Commission, and may also contact your state attorney general and the FBI's Internet Crime Complaint Center. The FTC says to report phishing at ReportFraud.ftc.gov and to forward phishing emails to the Anti-Phishing Working Group at reportphishing@apwg.org.
What should I do if I clicked or gave my details?
Citi says to contact your bank or credit card issuer, and that changing your account passwords can help prevent fraudsters from accessing your accounts. It also says to update your security software and scan your computer. If you lost money, it says you may ask your financial institution to reverse fraudulent charges.
Every step on this page comes from these official pages.
Read on . Spot a step that has changed? Email support@batmail.ai and we will fix it.