Reviewed guide | 2026-10-10
Reading the real sender and destination in exchange phishing messages
Phishing messages imitate exchange branding closely, but the sender and link destination usually give them away. How readers in Singapore can inspect both safely on a phone or computer before trusting any message about their account.
Multiple exchanges | Singapore | SGD | fees, access and account safety
A phishing email can copy an exchange's logo, colours and tone perfectly. What it cannot easily copy is the real sending address and the real destination of its links. Those two details are where most fakes reveal themselves, yet many people never look at them, especially on a phone where the display name hides the actual address. This guide shows how to check the sender and the link target safely, without clicking, and explains the official verification options the large exchanges provide. The safest habit remains the same: act only from inside the app you installed yourself.
Look past the display name
Email apps show a friendly display name that anyone can set. Tap or hover over it to reveal the actual address. Look carefully at the part after the at sign: extra words, swapped letters, unusual endings or a free email provider are warning signs. Text messages are harder, because sender names can be spoofed, so treat any text asking you to act urgently with suspicion regardless of the sender name shown.
Inspect link destinations without opening them
On a computer, hovering over a link usually shows its destination at the bottom of the window. On a phone, a long press may show a preview of the address without opening it. Compare the domain carefully with the one you normally type yourself. Attackers use lookalike spellings, extra subdomains and shortened links. If you cannot confirm the destination with certainty, do not open the link at all.
Use the exchange's own verification tools
Several large exchanges provide an official verification page where you can check whether an email address, website, phone number or social media account really belongs to them. Reach that page from the app or a domain you type yourself, never from the suspicious message. Many also support an anti-phishing code that appears in genuine emails. Enable it on each exchange you use so that a missing code becomes an immediate red flag.
Report and clean up
When you identify a phishing message, report it through your email provider's phishing option and, if the exchange provides a reporting address or form, use it from inside the help centre. Delete the message afterwards so nobody else on the device opens it. If you already entered details on a fake page, change your password from the app at once, end other sessions and review withdrawal settings and API keys.
Risk boundary: Singapore Crypto Guide
Digital assets are volatile and derivatives can amplify losses. This website has no login, wallet connection, deposit form or customer-support chat. A referral link only records attribution; it does not guarantee access, pricing, rewards, approval or investment results. Availability can differ by residence, legal entity and product, so no regional access is assumed from language or branding alone.
Scenario checkpoint
- Reveal the real sending address behind the display name before trusting any exchange email.
- Preview a link destination with a long press or hover and compare its domain carefully.
- Check doubtful addresses on the exchange's official verification page reached from the app.
- Enable an anti-phishing code on every exchange account so missing codes stand out.
Digital assets are volatile and derivatives can amplify losses. This website has no login, wallet connection, deposit form or customer-support chat.