A fake verification email works by stealing urgency. Slow down and check whether you requested it, which address received it, and whether the message asks for secrets.

None of this triage exists to hurry you past a security prompt. A one-time code is bait precisely because it is powerful, and a fake email works by rushing you into spending that power on an attacker's page. Every check in this guide keeps you on surfaces the provider controls: the site you typed in yourself, the account's real inbox, and the report tools built into Gmail. When something smells wrong, the provider's security page is the destination, never the message's own buttons.

Quick answer

Run the triage on context before content: did you initiate a login in the last few minutes, on a page you navigated to yourself? A yes narrows attention to the one message matching that request; a no means the email gets investigated, not obeyed. The table catalogs the classic tells, and Gmail's report tools are the disposal route for confirmed fakes. Codes that fail on the genuine site get resolved through the provider's recovery pages, never through links in mail.

Situation	What it usually means	Better next move
Unexpected email	You did not request a login.	Do not click; visit the official site directly.
Secret request	Email asks for password, code, card, or recovery phrase.	Treat as suspicious.
Sender mismatch	Domain looks close but wrong.	Compare against official provider communications.
Wrong destination	Sent to an unrelated address.	Do not use it for another account.
Urgency	Threatens closure or loss.	Verify through official channels.

Context is the first security signal

Timing is evidence you already own. You know whether you were mid-login when the message landed, and no attacker can retrofit that fact. An unrequested code can also mean someone else is entering your address into a login form, which is a reason to visit the provider directly and review account activity, not a reason to interact with the email. Type the site's address yourself or use your own bookmark; arriving under your own steam is the whole protection. If the real code landed in Spam, see how to check a code in Spam safely. If you didn't start a login and the message looks genuine, what an unrequested code means sorts it by kind of code.

Never trade one secret for another

Legitimate code emails deliver a secret; they do not solicit one. The moment a message wants you to reply with the code, confirm a password, or supply card details to keep your account open, you are looking at the scam's actual payload. FTC guidance calls out exactly this pattern of requests for sensitive information under account-alert pressure. Close the message and use Gmail's report phishing option so the next copy gets caught upstream.

Use Gmail search as an audit trail

Your own mail history is a reference library of what the real provider sounds like. Pull the last few genuine messages from the service (for example from:service.example older_than:7d) and set them beside the suspect: the sending domain behind the display name, the address each was delivered to, the footer details, the tone. A lookalike often betrays itself in this comparison even when it survives a glance in isolation. When it fails the comparison, Gmail's spam and phishing reporting is the right disposal path, not the trash icon.

Where MagicLess fits

When a login page you chose to visit needs a code, MagicLess shows the newest match from your connected Gmail after one click, so you do not open the email. Its limits are part of the safety story: it cannot pronounce a suspicious email genuine, cannot stop a phishing site from asking, and never submits anything on its own.

Claim ledger

Claim	Source	Last checked
FTC phishing guidance covers suspicious messages that request sensitive information or use urgent account warnings.	Source	2026-09-07
Gmail provides a built-in way to report a message as phishing.	Source	2026-09-13
Authentication secrets should be protected from disclosure.	Source	2026-09-07
CISA advises verifying unexpected messages through a known-good channel and reporting phishing rather than engaging with it.	Source	2026-09-13
Reporting spam in Gmail moves the message out of the inbox and helps filter similar mail later.	Source	2026-09-13

Sources

FTC Consumer Advice - How to recognize and avoid phishing scams: https://consumer.ftc.gov/articles/how-recognize-and-avoid-phishing-scams
CISA - Recognize and report phishing: https://www.cisa.gov/secure-our-world/recognize-and-report-phishing
Google Gmail Help - Avoid & report phishing emails: https://support.google.com/mail/answer/8253?hl=en
Google Gmail Help - Report spam in Gmail: https://support.google.com/mail/answer/1366858?hl=en
NIST SP 800-63B - Digital Identity Guidelines: Authentication: https://pages.nist.gov/800-63-4/sp800-63b.html