Skip to main content
CoveScreen.
Free tool

Phishing Awareness Checker

Check suspicious emails, messages, and URLs for common phishing warning signs.

Paste a suspicious email, SMS or chat message, or a URL, and review the patterns this tool knows about. Analysis runs in your browser: nothing is uploaded, and submitted URLs are never opened or resolved.

Your message and URL are analyzed locally in your browser. CoveScreen does not upload the content through this tool. Do not enter passwords, authentication codes, private keys, financial details, or confidential business information.

What would you like to check?

Paste the text of a suspicious email, SMS, or chat message. Remove any personal or confidential information before submitting.

0 characters · Up to 10,000 characters

Analyzing a copy is safer than the original: remove names, account numbers and anything else you would not paste into a public form.

Example messages and URLs

The examples below are fictional and written for training. They are not real phishing messages, and they contain no working malicious links. Use them to practise reading a message critically.

Example 1: Suspicious account message
Your account will be suspended today. Click here to verify your password immediately.
  • · Pressure to act quickly, alongside a same-day deadline.
  • · Threat of account suspension if nothing is done.
  • · A request to confirm a password, which no real service needs.
  • · An instruction to follow a link rather than use a known address.
Example 2: Unexpected payment request
Please transfer the outstanding amount immediately using the new bank details attached.
  • · An unexpected payment instruction arriving out of the blue.
  • · Changed bank details, which is a common business email compromise pattern.
  • · A reason to verify through a known contact method rather than the one supplied.
Example 3: Suspicious delivery message
Your package could not be delivered. Confirm your details using this link.
  • · An unexpected delivery claim used as the pretext.
  • · A request to confirm personal details.
  • · A link-based action request with no other way to check.
Example 4: Ordinary service notification
Your monthly service statement is available. Sign in through the official website using your saved bookmark to view it.
  • · A notification alone is not suspicious, which is the point of this example.
  • · It recommends navigating independently to a known website, rather than following a link.
  • · Context and sender verification still matter, so the checker still reports what it finds.

Check Another keeps your text so you can run a second check without pasting it again, and Clear Input empties the field and its result.

How to Use the Phishing Awareness Checker

To check a message

  1. Select Email / Message mode.
  2. Paste the suspicious message into the input box.
  3. Remove any personal or confidential information first.
  4. Click Check Message.
  5. Review the detected indicators and explanations.
  6. Follow the recommended precautions and verify unexpected requests independently.

To check a URL

  1. Select URL mode.
  2. Paste the URL into the input box.
  3. Click Check URL.
  4. Review the hostname and detected URL characteristics.
  5. Avoid opening suspicious links and visit trusted websites through known addresses.

Important reminder

The checker analyzes text patterns only. It does not visit the website, authenticate the sender, or confirm whether a message is malicious.

How to Recognise a Phishing Attempt

Attackers reuse a small number of techniques, because they work. Recognising them is the single most useful defensive skill in email and messaging.

Common phishing indicators

  • Pressure to act immediately or a deadline that discourages checking.
  • A request for a password, one-time code, or recovery code.
  • An unexpected request to change payment or bank details.
  • A link whose visible text does not obviously match its destination.
  • An unexpected attachment.
  • An announcement of a prize, refund, or credit you did not apply for.
  • Claims to come from an organisation, department, or executive.
  • A sender address, reply-to, or domain that does not quite match the organisation it names.

How Attackers Try To Recognise You

Urgency and fear

Attackers may pressure users into acting before they verify a request. A deadline is a prompt to check, not a reason to skip checking.

Credential theft

Unexpected requests for passwords, one-time codes, or recovery codes should be treated cautiously. No genuine service asks for these in a message.

Suspicious links

A link's visible text may differ from its actual destination. Avoid following unexpected links, and check the destination before you click.

Impersonation

Messages may claim to come from a bank, employer, service provider, or authority. Verify unexpected requests independently.

Unexpected attachments

Unrequested attachments can carry risk. Follow organizational security procedures before opening them, even from people you know.

Payment fraud

Unexpected changes to payment instructions should be verified using an independently obtained contact method, never the one supplied in the request.

HTTPS does not mean safe

HTTPS encrypts a connection but does not prove that the website is honest or trustworthy. Anyone can obtain a certificate.

Low risk does not mean safe

A message can be malicious without matching the tool's simple detection rules. A low indicator count is an absence of evidence, not evidence of absence.

What to do when something looks wrong

  1. Stop and read the message without clicking anything.
  2. Check the sender's full address, not just the display name.
  3. Reach the organisation using an address or number you already have.
  4. Never use contact details supplied inside the suspicious message.
  5. Report the message through your organisation's security process, then delete it.
  6. If you have already entered details, change the password and contact your security team promptly.

Recommended actions for any suspicious message

  • Do not click unexpected links or open unexpected attachments.
  • Do not share passwords, one-time codes or recovery codes in response to a message.
  • Reach the organisation through an address or number you already know, rather than one in the message.
  • Contact the sender through a channel you already trust, to confirm the request is genuine.
  • Report the message to your IT or security team if your organisation has a process for it.

Example messages and URLs

The examples below are fictional and written for training. They are not real phishing messages, and they contain no working malicious links. Use them to practise reading a message critically.

Example 1: Suspicious account message

Your account will be suspended today. Click here to verify your password immediately.
  • · Pressure to act quickly, alongside a same-day deadline.
  • · Threat of account suspension if nothing is done.
  • · A request to confirm a password, which no real service needs.
  • · An instruction to follow a link rather than use a known address.

Worth checking: several of these patterns are typical of phishing.

Example 2: Unexpected payment request

Please transfer the outstanding amount immediately using the new bank details attached.
  • · An unexpected payment instruction arriving out of the blue.
  • · Changed bank details, which is a common business email compromise pattern.
  • · A reason to verify through a known contact method rather than the one supplied.

Worth checking: several of these patterns are typical of phishing.

Example 3: Suspicious delivery message

Your package could not be delivered. Confirm your details using this link.
  • · An unexpected delivery claim used as the pretext.
  • · A request to confirm personal details.
  • · A link-based action request with no other way to check.

Worth checking: several of these patterns are typical of phishing.

Example 4: Ordinary service notification

Your monthly service statement is available. Sign in through the official website using your saved bookmark to view it.
  • · A notification alone is not suspicious, which is the point of this example.
  • · It recommends navigating independently to a known website, rather than following a link.
  • · Context and sender verification still matter, so the checker still reports what it finds.

Context, not a warning sign: this shows why a low indicator count is not proof of safety.

Example 5: Shortened link hiding its destination

https://bit.ly/3exampleDocReview
  • · The destination is hidden until the link is followed.
  • · This tool cannot resolve shortened links, so it cannot say where it goes.
  • · The real lesson: reach the site by typing its known address instead.

Worth checking: several of these patterns are typical of phishing.

Example 6: An ordinary login URL

https://login.example-service.com/account
  • · Uses HTTPS and a conventional hostname structure.
  • · Contains a sign-in word in the path, which is normal and is reported as context only.
  • · Structure cannot tell you who operates the site, only how it is written.

Context, not a warning sign: this shows why a low indicator count is not proof of safety.

Limitations and Scoring

This is a local, rule-based awareness check. It cannot confirm whether a message or URL is legitimate or malicious. A low indicator count does not guarantee safety.

The checker adds up fixed weights for each pattern it recognises, then maps the total onto one of four bands. The thresholds are deliberately visible so you can see how the result was reached:

  • Low indicators detected — a score of 0 or more
  • Some warning signs — a score of 2 or more
  • Several warning signs — a score of 4 or more
  • Many warning signs — a score of 7 or more

None of these bands means “safe”, and none of them means “confirmed phishing”. The score is a prompt to verify, nothing more.

Frequently asked questions

What is a phishing awareness checker?

A phishing awareness checker reviews messages and URLs for common patterns that may be associated with phishing. It helps users recognize warning signs and make more informed decisions.

Can this tool confirm that an email is phishing?

No. It uses local, rule-based pattern analysis to identify possible warning signs. It cannot verify the sender's identity, email authentication, or actual intent.

Can this tool tell me if a website is safe?

No. It reviews URL characteristics but does not visit or scan the website. A low indicator count does not mean that a website is safe.

Does this tool open or visit the URL I enter?

No. The initial version analyzes the URL string locally in the browser and does not send a request to the destination.

Does CoveScreen store the message I check?

The tool should process the content locally and should not store or upload submitted messages or URLs.

What should I do if I suspect phishing?

Avoid interacting with the message, do not share sensitive information, verify the request through a trusted channel, and report it according to your organization's security procedures.

Can legitimate messages trigger warnings?

Yes. Legitimate notifications may contain urgent wording, links, or payment references. The tool reports patterns, not a definitive verdict.

Can a phishing message receive a low indicator score?

Yes. Phishing messages can use language or URL structures that are not covered by the tool's rules. Always consider the context and verify unexpected requests.

Does HTTPS mean a website is legitimate?

No. HTTPS protects the connection to a hostname but does not establish that the website is operated by a trusted organization.

Is the checker a replacement for antivirus or security software?

No. It is an educational awareness utility, not an antivirus product, email security gateway, threat-intelligence service, or incident response platform.

How your data is handled

Submitted messages and URLs are analyzed locally in your browser. This tool does not upload, store or log them, and it never requests or resolves a submitted URL. Do not enter passwords, one-time codes, private keys, financial details or confidential business information.

More Free IT Tools