Expand the full address and compare the domain after @ with an address you know independently. A display name proves little. Even a matching address can be spoofed or belong to a compromised account.
Look beyond the display name
Mail apps often show only a name such as ‘Customer service’. Open the sender details using the name, an arrow or the details control. On a phone, tapping the name often reveals the address. Read it to the end without touching links in the message. In service@example.ch, the domain is example.ch; a familiar word before @ is not enough.
Compare sender and reply-to
Some apps also show a separate reply-to address. An unexpected difference calls for another check; do not send a test reply. Legitimate businesses may use mailing services, so an unfamiliar domain is a clue rather than a verdict. Verify it through the provider's official contact details.
The correct address is not a guarantee
A displayed address can be forged, and criminals can gain access to genuine mailboxes. A sudden change of bank details is suspicious even in an existing conversation. SPF, DKIM and DMARC may help verify mail transport, but they do not establish whether an invoice or instruction is legitimate. Confirm unusual requests through a second, known channel.
Read the whole address and independently confirm unusual requests.
Sources and further help
The linked information supports this guide. It does not imply that these organisations work with or endorse MailMigo.