The checker reads one suspicious email. Batmail reads your whole inbox overnight.
Paste the TD Bank email into the checker and it reads it for the signs below.
The checker reads the sender address, the wording, any link address you paste with the email and what the email asks you to do. It gives a verdict, a risk score from 0 to 100, the exact wording behind each red flag and what to do next. It is free and needs no signup.
Batmail phishing email checker
A fake TD Bank email says your online banking is locked, then asks for your account number, PIN and one-time code.
TD Bank’s pages on phishing and on its Security Center describe how these messages work. The email below is invented, and each number is one of the signs.
Example
Dear client,
We locked your online banking after a failed sign-in. Verify within 6 hours, or the lock stays.
Confirm your account number, PIN and password at the link below.
Reply with the one-time code we text you to finish.
The button says td.com/unlock
The sender's address is at a domain someone else owns.
TD says a phishing email often uses the name and logo of a legitimate company. The TD pages we read do not list the addresses TD sends from, so read the domain from the right.
Fear and a deadline.
TD says legitimate companies don't use urgent unsolicited communications or pressure tactics asking for personal information, and that creating fear or a sense of urgency is a common tactic.
A request for your account number, PIN and password.
TD says it will never ask you to confirm your account number, PIN, password or any other personal information via email, text or voice call.
A request for a one-time code.
TD says to never respond to one-time passcode requests that you didn't make.
A button that says td.com and goes somewhere else.
TD says not to use unknown links to access Online Banking, and that links or attachments in fraudulent messages may install viruses or keystroke loggers.
From TD Bank: How to prevent phishing, vishing and SMShing attacks, read 9 November 2026.
From TD Bank: Security Center, read 9 November 2026.
Read the sender's address from the right, because the last two parts say who owns it.
Anyone can put “TD Bank” in front of an address. The part to read is the domain, after the @ in a sender or after the https:// in a link. Read it from the right: the last two parts name the owner, and everything in front of them is only a label the owner chose. TD Bank’s security pages are at www.td.com, and the owner of that address is td.com. The TD pages we read do not list the addresses TD sends from, so the rule here is the one every address follows.
Read the domain from the right
www.td.com
From TD BankOwned by td.com. This is the address of TD Bank's own security pages.
td.com.secure-unlock.example
Not from TD BankOwned by secure-unlock.example. td.com is only a label in front of it.
td-secure-notice.example
Not from TD BankOwned by td-secure-notice.example. The name has TD in it, but the owner is someone else.
From TD Bank: How to prevent phishing, vishing and SMShing attacks, read 9 November 2026.
TD Bank says it will never ask you to confirm your account number, PIN or password by email, text or call.
TD Bank’s pages give short rules for what it will not ask and what to do with a message that says it is from TD. A fake account alert breaks at least one of them.
| Question | What TD Bank says | What a fake account alert does |
|---|---|---|
| Will TD ask me to confirm my account number, PIN or password? | What TD Bank saysTD says it will never ask you to confirm your account number, PIN, password or any other personal information via email, text or voice call. | What a fake account alert doesAsks you to confirm all three at a link. |
| Will TD pressure me? | What TD Bank saysTD says legitimate companies don't use urgent unsolicited communications or pressure tactics asking for personal information. | What a fake account alert doesSays your online banking stays locked unless you act within 6 hours. |
| Will TD ask for a one-time code? | What TD Bank saysTD says to never respond to one-time passcode requests that you didn't make. | What a fake account alert doesAsks you to reply with the one-time code it texts you. |
| Which links should I use for Online Banking? | What TD Bank saysTD says not to use unknown links to access Online Banking. | What a fake account alert doesA button that says td.com and opens another site. |
| What can a fake link or attachment do? | What TD Bank saysTD says links or attachments in fraudulent messages may install viruses or keystroke loggers and should not be clicked on or opened. | What a fake account alert doesPushes you to click or open before you think. |
From TD Bank: Security Center, read 9 November 2026.
From TD Bank: How to prevent phishing, vishing and SMShing attacks, read 9 November 2026.
TD Bank says to contact the company named before you give any information, and not to reply.
TD Bank says it is critical to make sure you are talking to a credible source. It gives one address for suspicious emails and one number for reporting a phishing attempt.
What to do with a message that says it is from TD Bank
- Do not reply
Do not engage with the sender.
TD says not to reply to or engage with the sender in any way.
- Call a number you know
The number on the back of your card.
TD's example is to call the number on the back of your credit card to confirm that any email, text or call about that card is real.
- Forward the email
To Phishing@TD.com.
TD says to forward suspicious emails to Phishing@TD.com, and gives 1-800-893-8554 for reporting a phishing attempt.
From TD Bank: How to prevent phishing, vishing and SMShing attacks, read 9 November 2026.
Five steps tell you whether a TD Bank email is real without clicking anything.
- Do not reply, and leave every link and attachment alone. TD says not to reply to or engage with the sender, and that links or attachments may install viruses or keystroke loggers.
- Read the sender’s actual address from the right, as in the picture above.
- Check your account by calling the number on the back of your card or opening TD’s app or site yourself. TD says to contact the company named before you provide any information, and the FTC says to use a phone number or website you know is real, not the information in the email.
- Paste the email into the checker at the top of this page for a second read.
- Forward the email to Phishing@TD.com. In Gmail you can also choose More next to Reply, then Report phishing.
Steps from TD Bank: How to prevent phishing, vishing and SMShing attacks, read 9 November 2026.
Steps from FTC Consumer Advice: How To Recognize and Avoid Phishing Scams, read 9 November 2026.
Steps from Gmail Help: Avoid & report phishing emails, read 9 November 2026.
If you clicked or gave your details, TD Bank says to call 1-800-893-8554.
TD Bank’s phishing page gives no steps for a click on its own. Its Security Center says that if you are concerned that you received a fraudulent email, text or call, or disclosed confidential information, you should call 1-800-893-8554. It also says you can lock your credit and debit cards, and lists 1-888-751-9000 for a lost or stolen debit card and 1-888-561-8861 for a credit card.
What to do depends on what you did
You only read it.
Forward it to Phishing@TD.com.
You clicked or gave your details.
Call TD at 1-800-893-8554 if you are concerned that you received a fraudulent email, text or call, or disclosed confidential information.
You gave card or identity details.
Lock your credit and debit cards from TD’s Security Center, then follow the steps at IdentityTheft.gov for what you shared.
From TD Bank: Security Center, read 9 November 2026.
From TD Bank: How to prevent phishing, vishing and SMShing attacks, read 9 November 2026.
From FTC Consumer Advice: What To Do if You Were Scammed, read 9 November 2026.
From FTC Consumer Advice: How To Recognize and Avoid Phishing Scams, read 9 November 2026.
The same checks work on other bank emails.
An account alert can borrow the name of any bank. The guide to fake Chase emails covers a call to move your money to a safe account, the guide to fake Wells Fargo emails covers a request to install a support tool, and the guide to fake Bank of America emails covers a message that tells you not to call. The holiday scam emails guide puts the kinds side by side.
These are the questions people ask next.
How can I tell a real TD Bank email from a fake one?
TD says legitimate companies don't use urgent unsolicited communications or pressure tactics asking for personal information. It says fraudulent emails, texts and calls ultimately seek things like online log-in credentials, Social Security numbers, account numbers and passwords, that creating fear or a sense of urgency is a common tactic, and that links or attachments may install viruses or keystroke loggers. The TD pages we read do not list the addresses TD sends from.
What does TD Bank say it will never ask for?
TD says it will never ask you to confirm your account number, PIN, password or any other personal information via email, text or voice call. It also says never to share your passwords and PINs, even with TD, and never to respond to one-time passcode requests that you didn't make.
What should I do before I respond to a message that names TD?
TD says to contact the company named in the email or text before you provide any information, and not to reply to or engage with the sender in any way. Its example is to call the number on the back of your credit card to confirm that any email, text or call about that card is real.
Where do I report a fake TD Bank email?
TD says to forward suspicious emails to Phishing@TD.com, and to report identity theft or a phishing attempt at 1-800-893-8554. In Gmail you can also choose More next to Reply, then Report phishing.
What if I clicked or gave my details?
TD's phishing page gives no steps for a click on its own. Its security center says that if you are concerned that you have received a fraudulent email, text or call, or disclosed confidential information, you should call 1-800-893-8554. It also says you can lock your credit and debit cards, and gives 1-888-751-9000 for a lost or stolen debit card and 1-888-561-8861 for a credit card.
What are phishing, smishing and vishing?
TD says phishing involves an email, often using the name and logo of a legitimate company, that asks you to click a link and provide account details, which are then used to commit fraud. It says smishing is phishing by text message, and vishing is phishing by phone call.
Every step on this page comes from these official pages.
Read on . Spot a step that has changed? Email support@batmail.ai and we will fix it.