Loading page
Sealine is a private demonstration page, not an email provider or security vendor, and is not affiliated with any company named on it.
Secure email
Email cannot prove who sent it
The sender name on a message is free text. Anyone can type anything into it. The authentication that exists checks a domain, not a person — and a look-alike domain the sender owns outright passes every check cleanly. Which is why the habit below matters more than any setting.
The message shown below was written for this page. It is not a real email and the addresses in it do not exist.
Read it the way an attacker wrote it
A message with the tells marked on it
Every guide describes what phishing looks like. Almost none of them show you one. The tells are numbered on the right, and none of them require you to inspect a header.
FromBilling Support <billing@account-secure-notice.com>
Reply-tosupport.desk.9915@mail-relay-inbox.net
Toyou@example.com
SubjectAction required: your subscription could not be renewed
Dear Customer,
We attempted to renew your subscription and the payment was declined. Your account is scheduled for suspension within 24 hours unless your billing details are confirmed.
To keep your account active, confirm your payment method using the secure link below. This link expires shortly for your protection.
Confirm billing detailsNot part of the message. The link text above reads account-billing.com. The destination it carries is somewhere else entirely — link text is decorative and can say anything.
“Dear Customer”
A company that bills you knows your name. Generic address at the top is the cheapest tell there is, and it survives because the message is sent to thousands of people at once.
The domain is a look-alike, not a typo
account-secure-notice.com is a domain someone registered and owns. It passes SPF, DKIM and DMARC perfectly, because the checks confirm the sender controls that domain — not that the domain is the one you think.
Reply-to points somewhere else
The visible sender and the address your reply would actually go to are different. Legitimate billing mail almost never splits those, and most mail clients hide the difference until you press reply.
A deadline you cannot verify
Twenty-four hours exists to stop you checking. Real account problems do not resolve themselves in a day, and no genuine provider makes suspension contingent on speed of response to an email.
The link text is not the destination
Link text is decorative — it can say anything while pointing anywhere. On a phone you often cannot preview the target at all, which is why phishing performs better on mobile.
It wants you to start from here
Every part of the message pushes you to begin at their link rather than at your own bookmark. That is the whole mechanism, and refusing it is the entire defence.
In order of how much they actually do
What protects you, honestly ranked
Most of the value sits in the first two. The rest is worth doing and will not save you on its own.
Does the most
Never start from the link
Open the site the way you normally open it — your own bookmark, the app, the address you have always typed. A convincing message becomes harmless the moment you refuse to use its route in.
Does a lot
Passkeys, or an authenticator app
A passkey cannot be handed to a look-alike site, because it is bound to the real domain. An authenticator app is the next best thing. SMS codes are better than nothing and are the one factor that can be intercepted or talked out of you.
Worth doing
A separate address for money
One address for banking and government, another for shopping and newsletters. When the second one leaks — and it will — nothing that arrives there can be about your accounts, which makes the fake obvious.
Worth knowing
Filters and forwarding rules
A common move after an account is taken over is a quiet rule that forwards or deletes mail. Check your own rules occasionally; an inbox that has stopped showing you receipts is not a mail glitch.
It happens to careful people
If you already clicked, in order
Clicking alone rarely does the damage. What you typed afterwards is what matters, so the order below starts there.
Change that password first
Do it from a different tab you opened yourself, not from anything in the message. If the same password is on other accounts, those are compromised too — change them in order of what holds money or mail.
Sign out everywhere
Most services have a “sign out of all sessions” control in security settings. A stolen password is often used hours later; ending existing sessions closes that window and forces a fresh sign-in you will see.
Read your own mail rules
Check forwarding, filters and recovery addresses on the email account itself. This is the step people skip, and it is the one that lets an intruder keep reading after you have changed the password.
Turn on a second factor if it was off
A passkey or an authenticator app on the mail account before anything else. Your inbox is the reset route for every other account you own, which makes it the one worth protecting first.
Report it, then leave it alone
Forward the message to the Anti-Phishing Working Group and report it to the FTC. Do not reply to it, and do not engage to see what happens — a reply confirms the address is read by a person.
Straight answers
Questions people actually ask
- It passed my provider's security checks. Does that mean anything?
- Less than it sounds. SPF, DKIM and DMARC confirm that whoever sent the message controls the domain it came from. If that domain is one the attacker registered last week, every check passes and the message is still hostile.
- Is a paid secure-email service worth it?
- For encryption between two people who both use it, yes. For phishing, not much — the message still arrives, and the tells are still the same. Buy it for privacy from your provider, not as a shield against being deceived.
- Should I use email aliases?
- They are genuinely useful. A unique address per service tells you exactly who leaked when the spam starts, and it lets you switch off one address without changing your real one.
- How do I check a link on a phone?
- Press and hold rather than tapping; most apps then show the destination. If that feels awkward, treat it as a reason not to tap at all and open the site yourself — which is the better habit anyway.
- The message came from someone I know. Is it safe?
- Not necessarily. A compromised account sends genuine mail from a genuine address, which is why these are the hardest to spot. If a known contact asks for money or credentials, verify through any channel other than the email.
- Is my provider's spam folder enough?
- It removes the obvious volume. What reaches your inbox is the mail that was written well enough to get through, so the filter cannot be the last line — by definition you only ever see its failures.
Go straight to the source
Official references, none of them selling a product
- reportphishing@apwg.orgThe Anti-Phishing Working Group's reporting address for forwarded messages.
- ReportFraud.ftc.govThe FTC's front door for phishing and scam reports.
- CISA — phishing guidanceFederal guidance on recognising and reporting a phishing message.
- FBI IC3For anything that moved money, especially business email compromise.
- Have I Been PwnedWhich breaches an address has appeared in, run by a security researcher.
- FIDO Alliance — passkeysHow passkeys work, from the body that defines the standard.
One email, then we leave you alone
Keep the six tells somewhere you will see them
The checklist fits on one page: the tells from the specimen, the two settings worth changing, and the habit that makes the rest optional.