Tracing Email Scams: Tools and Techniques for Identifying Senders

We all rely on email for important business and banking notifications. Unfortunately, scammers know this and exploit it by sending fake emails that claim your bank account or credit card details have been compromised. These emails often look convincing, but they’re designed to steal your information.

Well, don’t let them fool you. These sneaky scammers are just trying to scare you into handing over your personal information. According to GetAstra.com, around 1.2% of all emails sent are malicious. That’s roughly 3.4 billion phishing emails every single day. Google’s doing its part, blocking around 100 million of these nasty messages daily, but some still manage to slip through the cracks. And, unfortunately, a few unsuspecting folks fall for them, losing their hard-earned cash in the process.

So, how do you avoid these digital traps? The answer is simple: trace the origin of the email. That way, you can figure out if it really came from your bank or if it’s just some scammer named George, sitting halfway across the world, trying to get his hands on your money.

This blog is dedicated to beginners looking for tools and tips to protect themselves and their loved ones from email scams. Stay informed, stay safe, and learn how to spot these scams before they cost you.

Understanding the Basics of Email Tracing

Emails are a key part of how we communicate today, but they can also be a target for cyberattacks. Cybersecurity experts say that, on average, 121 business emails are sent and received each day, and many of them come from unknown sources or people.  You will be surprised to read that The United States of America currently leads as the country of origin of spam emails with 8,765 spam emails sent. From phishing scams to emails with harmful attachments, it’s important to know where an email comes from and if it’s safe. The email header, which is usually hidden, has important details that help you figure out the email’s source and if it’s real.

Every email has a hidden path that shows where it came from. This information is found in the email’s header, a part you don’t normally see. The header has technical details like the path the email took through servers and the IP address of the sending server. By looking at this, you can trace the email back to where it started. 

Key Steps to Analyze Email Headers:

1. From

The “From” field displays the sender’s email address. While it gives an initial clue about who sent the email, be cautious this field can be easily spoofed by attackers. Always cross-check this information with other elements of the header to verify its authenticity.

2. To

The “To” field shows the recipient’s email address. While it’s usually straightforward, analyzing this field can sometimes reveal if the email was part of a mass spam campaign, especially if multiple recipients are listed.

3. Date (Created At)

The “Date” field indicates when the email was sent. By comparing this with other header information, you can spot inconsistencies that might suggest tampering or delays caused by suspicious routing.

4. Subject

The “Subject” line gives a brief summary of the email’s content. While it doesn’t provide technical data, a mismatch between the subject and the actual content can be a red flag for phishing attempts.

5. Return-Path

The “Return-Path” is where bounce messages are directed. This field is particularly useful in identifying where a reply would be sent if the email failed to deliver. If the return path differs significantly from the sender’s address, it’s worth investigating further.

6. DomainKey & DKIM

DomainKeys Identified Mail (DKIM) adds a digital signature to the email. This ensures that the content hasn’t been altered after it was sent. By verifying DKIM, you can confirm that the email hasn’t been tampered with in transit.

7. Message ID

Every email is assigned a unique “Message ID.” This identifier is crucial for tracking the email across different servers. If you suspect an email is part of a phishing campaign, checking the Message ID can help you determine if the same email has been sent to multiple recipients.

8. MIME Version

The “MIME Version” indicates the email’s format, particularly if it includes attachments or non-text content. Understanding the MIME version can help you identify potential threats hidden in complex email structures, like embedded images or attachments.

9. Received

The “Received” field is arguably the most important for tracing an email’s origin. It shows the path the email took from the sender’s server to your inbox. By analyzing these entries, you can identify the email’s source and detect any unusual routing that might suggest spoofing.

10. X-Spam Status

This field shows if the email was flagged as spam by a spam filter. If the email bypasses this filter but still seems suspicious, you should manually inspect the header for inconsistencies.

11. Content-Type

The “Content-Type” indicates the nature of the email’s body, whether it’s plain text, HTML, or includes attachments. An email with a suspicious content type (e.g., an unexpected executable file) should be treated with caution.

How Access Email Headers?

From Yahoo to Google to Apple, many of us have multiple email accounts for both business and personal use. Each email provider offers a different method for accessing email headers, which are crucial for finding the origin and IP address of the sender.

Did you know that, according to Statista, Russia was the leading source of unsolicited spam emails in 2023? An astounding 31.5% of global spam emails came from Russian IPs, with the United States following at 11.3%, and mainland China close behind with just over 11%.

One of the biggest advantages of accessing email headers is that they provide accurate information about the sender’s IP address and timezone, helping you trace the email’s origin.

1. Accessing Email Headers in Gmail

Gmail is one of the most widely used email services, and it provides a straightforward way to access email headers.

Steps:

1. Start by logging into your Gmail account and opening the specific email whose header you want to view.
2. In the top-right corner of the email (near the reply button), you’ll see three vertical dots. This is the “More” menu.
3.  From the dropdown menu, click on “Show original.” This will open a new tab with the full email header and the raw message.

Professional Tips:

•  Once you have the header displayed, you can copy it for further analysis or use in an email header analyzer tool.
• The “Show original” option also allows you to view the email body in its raw format, which can be useful for spotting hidden code or scripts.

2. Accessing Email Headers in Outlook

Outlook is a popular choice for both personal and professional email management. Accessing email headers in Outlook is also a simple process.

Steps:

1. Sign in to your Outlook account and open the email for which you need to view the headers.
2.  Look towards the top-right of the email interface. You’ll see three dots labeled “More actions.”
3. From the dropdown menu, choose “View message source.” This will open a new window or tab displaying the full email header and source code.

Professional Tips:

• The message source will include both the header and the HTML or text content of the email, which can be helpful for in-depth analysis.
• This method works for both the web version of Outlook and the desktop application.

3. Accessing Email Headers in Yahoo Mail

Yahoo Mail users can also easily access the email headers to trace the origin of messages and verify their authenticity.

Steps:

1. Log in to your Yahoo Mail account and open the email you want to investigate.
2. Similar to Gmail and Outlook, Yahoo Mail features a “More” menu, represented by three dots, in the top-right corner of the email.
3. From the dropdown options, choose “View raw message.” This will display the full email header and the raw email content in a new window or tab.

Professional Tips:

• The raw message includes the full header as well as the email’s content. Use this information to trace IP addresses, verify sender details, and more.
• Pay close attention to any unusual entries in the header, such as mismatched “Received” lines or unexpected IP addresses.

4. Accessing Email Headers in Apple Mail

Apple Mail, the default email client for macOS and iOS devices, allows users to access email headers with a few clicks.

Steps:

1. Launch Apple Mail and open the email for which you want to view the headers.
2. In the top menu bar of the Apple Mail application, click on the “View” option.
3. A dropdown menu will appear. Hover over “Message” to see additional options.
4. Finally, click on “All Headers.” The email header information will now be displayed within the email view, providing details about the email’s journey.

Professional Tips:

• Apple Mail also allows you to view a more compact version of the header if you select “Default Headers” instead of “All Headers.”
• The “All Headers” view is particularly useful for technical analysis, as it provides complete details about the email’s routing and other metadata.

Reverse Email Lookup Tools to Trace Email Origins:

We’ve all heard the stories, someone unknowingly installs spyware just by opening an email from an unknown source. Phishing emails are sneaky; they trick you into clicking on a malicious link or attachment. These attacks can be tough to spot, and phishing is the most common cybercrime, with a whopping 3.4 billion spam emails sent daily.

 You might think that email is about a job offer or confirming an order you placed online, but there’s just as much chance it’s from a scammer.We’ve talked about how to check the origin of an email you receive, but there’s an even easier way to get detailed information about the sender. This method is called Reverse Email Lookup Tool. By simply putting the email address into one of these tools you can get the complete information and history of the sender. 

Following is the list of top Reverse Email Lookup tools you can find online. 

1.TruthScout

Paid or Free / Price:

• Basic Reverse Email Lookup: Free
• Premium Plans: Varying prices depending on the features selected

Features:

• Provides detailed reverse email lookup and background checks
• Accesses public records, social media profiles, and other online data
• Offers comprehensive reports with contact details, criminal records, and more
• Regularly updates its database to ensure accuracy
• Allows users to search by email, phone number, name, or address
• Ensures privacy by keeping user searches anonymous
• Provides a user-friendly interface for easy navigation
• Includes customer support via email or phone

How to Use:

• Visit the TruthScout website
• Enter the email address or other details in the search bar
• Choose the type of search (email, phone, name, address)
• Review the results, which may include contact info, social profiles, and background details
• Opt for a premium plan if you need more in-depth information

2. Spokeo

Paid or Free / Price:

• Basic Reverse Email Lookup: Free
• 7-Day Trial: $0.95 once, then $29.95 per month
• 1-Month Membership: $19.95 per month
• 3-Month Membership: $14.95 per month
• Professional: $69.95 per month

Features:

• Over 12 billion records for accurate information
• Search via email address, name, phone number, or address
• Data from social media, public records, and directories
• Reports include contact info, personal details, location history, and more
• Access to public records like criminal history and online profiles
• Opt-out feature to stop your info from being shared or sold
• US-based customer support via call or email

How to Use:

• Visit the Spokeo website
• Enter the email address
• Receive detailed information about the sender

3. Reverse Contact

Paid or Free / Price:

• Free Trial: 20 free credits
• Basic: $99 per month (2000 credits)
• Growth: $299 per month (10000 credits)
• Enterprise: $999 per month (100000 credits)
• Unlimited Partnership: $2,499 (unlimited credits)
• Pay-As-You-Go Packages: Starting at $200 for 2,000 credits

Features:

• Personal and business reverse email lookup
• Converts emails into LinkedIn data for your CRM
• Generates employee/company info from emails
• Provides accurate and timely data
• Supports CSV search or API options
• Comprehensive LinkedIn profiles for individuals and companies

How to Use:

• Enter an email into Reverse Contact
• Obtain LinkedIn data and other relevant information
• Integrate data into your CRM for business purposes

4. Social Catfish

Paid or Free / Price:

• Basic Reverse Email Lookup: Free
• Advanced Reports: Custom pricing

Features:

• Securely find and verify business/customer info
• Spot spammers/scammers and prevent fraud
• Search by email, phone number, username, address, or image
• Verify images and social profiles to avoid catfishing
• Private and secure searches
• Reliable customer support via calls and email

How to Use:

• Enter the email or other details into Social Catfish
• Get information like the user’s name, social media profiles, and more
• Use the data to verify the trustworthiness of the contact

5. BeenVerified

Paid or Free / Price:

• 1-Month Membership: $29.99 per month
• 3-Month Membership: $19.49 per month
• Free 7-day trial available

Features:

• Detailed contact information
• Property Search for locating nearby properties
• Identity Hub for managing reports
• Call Block feature to remove spam calls
• Safety Check for verifying information on sex offenders
• Expanded report sections include schools, vehicles, and more

How to Use:

• Sign up for a membership on BeenVerified
• Enter the email address to perform a reverse lookup
• Receive detailed reports on the sender

6. PeopleFinders

Paid or Free / Price:

• Standard Membership: $24.95 per month
• Premium Membership: $29.95 per month
• A few free searches included

Features:

• Search by full name, address, or city
• Detailed checks on individuals including contact info and property records
• Access to over 43 billion records
• Conduct searches anonymously
• Mobile app available for Android and iPhone

How to Use:

• Enter the email address or other details into PeopleFinders
• Obtain the sender’s full name and contact info
• Use additional searches for more details

7. That’sThem

Paid or Free / Price:

• One-Month Membership: $19.95 per month
• Three-Month Membership: $14.95 per month
• 10 free lookups per day

Features:

• Accurate email lookup from a large database
• Find details like name, address, and phone number
• Search using physical addresses or IP addresses
• Simple interface for easy use
• Option to opt-out and keep your information safe

How to Use:

• Enter the email address or other details into That’sThem
• Receive detailed information about the person
• Use the free lookups or opt for a membership for more searches

8. PeopleLooker

Paid or Free / Price:

• 1 Month: $23.99 per month
• 3 Months: $19.19 per month (billed at $57.57 per quarter)
• 7-day free trial available for $1

Features:

• Private reverse email searches
• Property analysis, including past owner data
• Norton-certified data security
• Notifications for changes in past search reports
• Adherence to legal standards
• Phone and email support available during specified hours
• Android app available

How to Use:

• Sign up for PeopleLooker
• Perform a reverse email lookup by entering the email address
• Access detailed background reports and other information

Conclusion

Accessing email headers is a critical step in safeguarding yourself from email-based threats like phishing and spoofing. Whether you’re using Gmail, Outlook, Yahoo Mail, or Apple Mail, the steps outlined above will help you uncover the hidden details in any email. By regularly checking and analyzing email headers, you can better protect yourself and your organization from potential cyber threats.