Email headers, and how there’s more than one email address to look for.

When you look at a scam email, the first thing you’ll see is the scammer’s email address. There could however be another email address you don’t see. Often the “from” and “reply to” addresses are different, and you can only see the latter by looking at the email’s headers. Here’s an example.

At first glance, you can see two different email addresses in this message, jpmorganchasebank31@gmail.com and arnaultb327@gmail.com are both clearly visible. Let’s take a look at the email headers though. The method is different depending on what you use to view your emails, but you’ll be looking for something like “show source”, “view original” or something similar. In the case of Yahoo! you can view them by clicking on the three dots and then on “View raw message”.

This is going to open up a new tab on your browser with what looks like a whole mess of uninteligible garbage.

Scroll down to just before the text of the email starts though, and more often than not you’ll find a “reply to” address.

Here are two examples that came in one after the other, both with different names in the “from” address, but the same “reply to” address:

Don’t worry if you can’t find one as it’s not 100% guaranteed there’ll be one. If you do find one though, then that’s the address that receives any replies to the email the scammer sent, and will continue to do so even if you try to get their “from” address closed. This is one of the reasons we say not to get an email address closed. Better to post up the email and any email addresses you find to warn others. If you want to see what a report looks like, check out https://scamsurvivors.com/forum/viewforum.php?f=6 and feel free to add any you receive too.