How do I verify a forwarded email?

Ask the mailbox owner to export the original email as a .eml file, then upload it to selfcheck.email. The DKIM signature on the original indicates whether the content is unchanged.

What does DKIM verification establish?

A valid DKIM signature establishes that the email content has not been altered since the sender's mail server signed it. It does not establish that the content is true or that a specific person wrote it.

Yes. You can verify up to 5 emails per hour without an account. Free accounts get 5 cases per month with timestamped PDF reports.

Does SelfCheck store my email?

No. The email file is processed in memory and deleted immediately. Only cryptographic hashes and the PDF report are retained.

← Guides

How to check if a bank email is fake or genuine

5 min

Why forged bank emails are dangerous

Fraudsters send fake bank emails to trick people into transferring money, revealing credentials, or accepting false documents (like fabricated balance confirmations used in visa or loan applications). These emails can be nearly impossible to distinguish from genuine ones by appearance alone.

Visual clues are not enough

A sophisticated fake will reproduce the bank's logo, colours, legal disclaimers, and even the sender's email address. Scammers use lookalike domains (e.g., "hsbc-secure.com" instead of "hsbc.co.uk") or spoof the From header entirely. You cannot rely on how the email looks.

What DKIM verification reveals

When you check the original .eml file with SelfCheck, you see:

·The signing domain — which domain's mail server actually signed the email. A genuine HSBC email will be signed by hsbc.co.uk or a related domain. A fake will either have no signature or be signed by a different domain.

·Domain alignment — whether the signing domain matches the From address. If someone spoofs the From to show "hsbc.co.uk" but the email is actually signed by "fake-bank.com", the alignment check flags this.

·Content integrity — whether the email content has been modified since signing. If someone intercepted a genuine email and changed the balance amount, the signature check will show a mismatch.

Step by step

1.Ask for the original email as a .eml file (not a forward or screenshot)

2.Upload it to selfcheck.email

3.Check three things in the result:

·Is the verdict Verified?

·Does the signing domain match the expected bank domain?

·Are the key headers (From, Subject, Date) covered by the signature?

Important caveats

A valid DKIM signature indicates the content is unchanged — not that the content is true. A genuine bank email might contain incorrect information, or the bank's systems might have been compromised. DKIM verification is one layer of checking, not the only one.

If you suspect fraud, report it to Action Fraud (UK) or your local authority. SelfCheck provides technical verification, not legal advice.

Try it now

Drop an .eml file on the homepage for an instant verification — no account needed.

Verify an email