Why Reply-To addresses matter

Most people know to check the sender's email address when they receive a suspicious message. But there's another field that scammers exploit more often than the From address: the Reply-To address.

The Reply-To address is where your message goes when you hit Reply. It can be completely different from the address that sent the email. And that difference can expose a scam that looks otherwise flawless.

What is the Reply-To address?

When you receive an email, there are several address fields involved. The From address is what appears in your inbox — it's the display address you see immediately. The Reply-To address is where your reply actually goes when you hit Reply.

These two addresses are completely separate. A legitimate company called Acme Ltd might send email from noreply@acme.com and have replies go to support@acme.com — a sensible setup. The key is that both addresses are on the same domain: acme.com.

Scammers abuse this by using a legitimate-looking From address — or even spoofing a real company's address — while setting the Reply-To to a free personal email account they control. When you reply, your message goes to the scammer. They can then continue the conversation as if they're the real company.

A real example of a Reply-To mismatch

At first glance, this email looks like a marketing message from a well-known electronics brand. The layout is professional. The branding is consistent. The Shopify sending infrastructure is legitimate — many real companies send marketing emails through Shopify.

But the Reply-To address — ezrafebus44@hotmail.com — is a personal Hotmail account with a random-looking username. A legitimate Anker or Shopify transactional email would never route replies to a personal Hotmail address. That single detail is the smoking gun.

When this email was put through Summarly, the Reply-To mismatch was flagged immediately and classified as High risk, despite the professional appearance of the email body.

Why scammers use this technique

The Reply-To trick is effective because most email clients don't show the Reply-To field prominently. You see the friendly display name and sender address. The Reply-To stays hidden unless you specifically look for it.

It's also harder to fake convincingly. A scammer can often make the From address look like support@barclaysbank.com using spoofing techniques. But when the victim replies, the response goes to wherever the Reply-To points — in this case, an account the scammer controls.

How to check the Reply-To address

The method varies slightly by email client, but here's how to find it in the most common ones:

In Gmail

Open the email. Click the three dots (...) next to the reply button in the top right of the message. Select Show original. Search for "Reply-To" in the raw email source.

In Outlook

Open the email. On the Message tab, click File then Properties. The Internet headers section will show the Reply-To field.

On iPhone Mail

Tap the sender's name at the top of the email to expand the address details. If a Reply-To address is set, it will appear there.

The quickest check

Simply hit Reply and look at where the email is addressed to before sending anything. If it goes to a different address than the one that sent the email — especially a free personal email service like Hotmail, Gmail, or Yahoo — treat that as a warning sign.

Warning signs to look for

• The Reply-To address uses a free personal email service (Hotmail, Gmail, Yahoo, Outlook.com) when the claimed sender is a brand or official organisation
• The Reply-To domain does not match the From domain
• The Reply-To address looks like a randomly generated username
• The From address looks official but the Reply-To is completely different
• The email encourages you to reply quickly — urgency is often used to stop you checking details

How Summarly checks this

If you paste a full email including the headers into Summarly, or paste the message with the From and Reply-To lines visible, Summarly checks whether the Reply-To domain matches the claimed sender. A mismatch with a free personal email account is flagged as a strong warning sign and raises the risk level accordingly.

This works best when you include the full email headers — the lines at the top of the raw email showing From, To, Reply-To, and Subject. You can get these using the "Show original" options described above.

Frequently asked questions