The checker reads one suspicious email. Batmail reads your whole inbox overnight.
Paste the USAA email into the checker and it reads it for the signs below.
The checker reads the sender address, the wording, any link address you paste with the email and what the email asks you to do. It gives a verdict, a risk score from 0 to 100, the exact wording behind each red flag and what to do next. It is free and needs no signup.
Batmail phishing email checker
A fake USAA email has no Security Zone, no name, and says an agent will call for a one-time code.
USAA’s page on how to tell it’s USAA says a real email shows “USAA Security Zone” with your name and the last 4 digits of your USAA number. The email below is invented, and each number is one of the signs.
Example
Dear member,
We noticed unusual activity on your account.
A USAA agent will call you today. Be ready to read out the one-time code we text you.
Confirm your account now with the link below, or we will lock it.
The button says usaa.com/confirm
The sender's address is not at usaa.com.
The display name says USAA, but the part after the @ belongs to someone else. USAA's page does not list the addresses it sends from, so this is a sign to weigh, not the only one.
No USAA Security Zone, no name, no last 4 digits.
USAA says a real email has "USAA Security Zone" with your name and the last 4 digits of your USAA number, and that if your information isn't right, it's probably a scam.
A call that asks for a one-time code.
USAA says it will never call you to ask for your password, PIN or one-time code, and that if someone calls and says they're a USAA employee and asks for any of these things, it could be fraud.
A link you are told to click, with a threat.
USAA says that if you're not sure about an email, you should not respond or click any links.
A button that says usaa.com and goes somewhere else.
The label on a button is not the address it opens. USAA says to forward an email that looks like it is from USAA but seems suspicious to abuse@usaa.com.
From USAA: How to tell it's USAA, read 8 November 2026.
Read the sender's address from the right, because the last two parts say who owns it.
Anyone can put “USAA” in front of an address. The part to read is the domain, after the @ in a sender or after the https:// in a link. Read it from the right: the last two parts name the owner, and everything in front of them is only a label the owner chose. USAA’s security help pages are at www.usaa.com, and the owner of that address is usaa.com. USAA’s page does not list the addresses it sends from. It gives a different check instead: a real USAA email shows “USAA Security Zone” with your name and the last 4 digits of your USAA number.
Read the domain from the right
www.usaa.com
From USAAOwned by usaa.com. This is the address of USAA's own security help pages.
usaa.com.member-secure.example
Not from USAAOwned by member-secure.example. usaa.com is only a label in front of it.
usaa-member-desk.example
Not from USAAOwned by usaa-member-desk.example. The name has USAA in it, but the owner is someone else.
From USAA: How to tell it's USAA, read 8 November 2026.
USAA says a real email shows your name and the last four digits of your USAA number.
USAA’s page gives short rules for the emails, texts and calls that use its name. A fake account alert breaks at least one of them.
| Question | What USAA says | What a fake account alert does |
|---|---|---|
| How can I tell an email is from USAA? | What USAA saysUSAA says a real email has "USAA Security Zone" with your name and the last 4 digits of your USAA number, and that if your information isn't right, it's probably a scam. | What a fake account alert doesOpens with Dear member and shows no Security Zone. |
| Will USAA call me for a code? | What USAA saysUSAA says it will never call you to ask for your password, PIN or one-time code. | What a fake account alert doesSays an agent will call to hear a code you were sent. |
| Can I trust the caller ID? | What USAA saysUSAA says not to trust caller ID, because scammers can easily manipulate it to seem legitimate. | What a fake account alert doesA call that shows USAA's name or number. |
| Is a text really from USAA? | What USAA saysUSAA says it might text you from a short code of 5 or 6 digits about your products or services or if it suspects fraud, and gives 698722 or 868722 as its Fraud and Account Security short code. | What a fake account alert doesA text with a link, from a number you do not know. |
| What if I am not sure about an email? | What USAA saysUSAA says not to respond or click any links, and to cut off potential scammers right away and delete the email. | What a fake account alert doesPushes you to click before you think. |
From USAA: How to tell it's USAA, read 8 November 2026.
To check a USAA message, hang up or delete it, then call the number on your card or statement.
USAA says to call using the number on the back of your card or account statement when a text or call seems suspicious, and that when in doubt, you should hang up and call USAA directly.
How to check a message that says it is from USAA
- Stop
Do not respond or click.
USAA says if you're not sure about an email, don't respond or click any links.
- Ignore the caller ID
It can say USAA when it is not.
USAA says the caller ID can say the call or text is from USAA, even though it's not.
- Call your own number
The one on your card or statement.
USAA says to call using the number on the back of your card or account statement.
From USAA: How to tell it's USAA, read 8 November 2026.
Five steps tell you whether a USAA email is real without clicking anything.
- Do not respond and do not click any links. USAA says that if you are not sure about an email, you should cut off potential scammers right away and delete it.
- Look for “USAA Security Zone” with your name and the last 4 digits of your USAA number. USAA says that if your information isn’t right, it’s probably a scam. Then read the sender’s actual address from the right, as in the picture above.
- Call USAA on the number on the back of your card or on your account statement. USAA says not to trust caller ID.
- Paste the email into the checker at the top of this page for a second read.
- Forward the email to abuse@usaa.com, as USAA says. In Gmail you can also choose More next to Reply, then Report phishing.
Steps from USAA: How to tell it's USAA, read 8 November 2026.
Steps from Gmail Help: Avoid & report phishing emails, read 8 November 2026.
If you think you were a victim of fraud, USAA says it will walk you through next steps.
USAA’s page has a heading for people who think they might be a victim of fraud, with a link to get help reporting it, and says USAA will walk you through next steps and get you the help you need. The page does not list steps for a click on its own. The FTC says that if something may have downloaded, you should update your computer’s security software, run a scan and remove anything it finds.
What to do depends on what you did
You only read it.
Forward it to abuse@usaa.com, then delete it.
You clicked.
Contact USAA on the number on the back of your card, so it can walk you through next steps. If something may have downloaded, update your computer's security software and run a scan.
You shared your login, a code or personal details.
Contact USAA on the number on the back of your card, then follow the steps at IdentityTheft.gov for what you shared.
From USAA: How to tell it's USAA, read 8 November 2026.
From FTC Consumer Advice: What To Do if You Were Scammed, read 8 November 2026.
From FTC Consumer Advice: How To Recognize and Avoid Phishing Scams, read 8 November 2026.
The same checks work on other bank emails.
An account alert can borrow the name of any bank. The guide to fake Wells Fargo emails covers a support tool that shares your screen, the guide to fake Bank of America emails covers an email that tells you not to call, and the guide to fake Chase emails covers a fraud alert that tells you to move your money. The holiday scam emails guide puts the kinds side by side.
These are the questions people ask next.
How can I tell a real USAA email from a fake one?
USAA says to make sure the email has "USAA Security Zone" with your name and the last 4 digits of your USAA number. It says that if your information isn't right, it's probably a scam. If you are not sure about an email, it says not to respond or click any links, and to delete the email.
Will USAA call and ask for my one-time code?
No. USAA says it will never call you to ask for your password, PIN or one-time code, and that if someone calls and says they are a USAA employee and asks for any of these things, it could be fraud.
What if the caller ID shows USAA?
USAA says not to trust caller ID, because scammers can easily manipulate it to seem legitimate. It says the caller ID can say a call or text is from USAA even though it is not, and that when in doubt, you should hang up and call USAA directly.
Where do I forward a fake USAA email?
USAA says that if an email looks like it is from USAA but seems suspicious, you should forward it to abuse@usaa.com. In Gmail you can also open the message, choose More next to Reply, then Report phishing.
How can I tell a text is really from USAA?
USAA says it might text you from a short code, a 5- or 6-digit phone number, about your products or services or if it suspects fraud. It gives 698722 or 868722 as its Fraud and Account Security short code. If you think a text is suspicious, it says not to respond and to call the number on the back of your card or account statement instead.
What should I do if I think I was a victim of fraud?
USAA's page has a heading for people who think they might be a victim of fraud, with a link to get help reporting it, and says USAA will walk you through next steps. The FTC says that if something may have downloaded, you should update your computer's security software and run a scan.
Every step on this page comes from these official pages.
Read on . Spot a step that has changed? Email support@batmail.ai and we will fix it.