Is This Email From My Bank Real? 60-Second Checks
Look at the domain after the @ first. A real email from a big Canadian bank comes from the bank's own domain, such as rbc.com, td.com, scotiabank.com, bmo.com or cibc.com, or a subdomain ending in exactly that. Anything else, including a lookalike such as rbc-secure.com, is not your bank. Then check the links before you click.
Check 1: the domain after the @
The name shown next to an email (“RBC Royal Bank”, “TD Alerts”) is free text that any sender can set. Open the full sender address and read the part after the @. That is the domain, and it is the first thing a phishing email gets wrong.
Read the domain from the right. The part that matters is the name directly before the ending (.com, .ca). In alerts.td.com, the registered domain is td.com. In td.com.secure-login.example, it is secure-login.example, which has nothing to do with TD.
These are the main official domains of the big five Canadian banks, with the address each bank asks customers to forward phishing to:
| Bank | Official domain | Report phishing to |
|---|---|---|
| RBC Royal Bank | rbc.com, rbcroyalbank.com | phishing@rbc.com |
| TD | td.com | phishing@td.com |
| Scotiabank | scotiabank.com | phishing@scotiabank.com |
| BMO | bmo.com | phishing@bmo.com |
| CIBC | cibc.com | fraud@cibc.com |
Is an email from a subdomain like alerts.td.com real?
Usually yes. Only the owner of td.com can create addresses under it, so anything ending in exactly “.td.com” is controlled by TD or a service it authorized. The trap is the reverse pattern: a domain that starts with the bank’s name but ends in something else, such as td.com.secure-login.example, belongs to whoever owns the ending.
Check 2: lookalike domains
Phishing domains are built to pass a quick glance. The usual patterns are:
- Extra words: the bank name plus “secure”, “alerts”, “verify” or “support”, joined with a hyphen, as in rbc-secure.com.
- Swapped endings: the right name with a different ending, such as .co, .net or .info instead of .com.
- Small typos: one letter added, dropped or swapped, which your eye corrects automatically.
- Brand as a subdomain: rbc.com or bmo.com placed at the front of an unrelated domain.
New lookalike domains are often days or weeks old when the email arrives. A domain’s registration date is public, and TrustOrNah’s email check shows it along with whether the domain imitates a bank, courier or government brand.
Can a scam email come from my bank’s real domain?
Rarely. When we checked on October 9, 2026, all five big banks published a DMARC policy of “reject” for their main domains. That tells receiving mail services such as Gmail and Outlook to refuse messages that claim the bank’s domain but fail authentication, so a simple forgery of the bank’s real address usually never reaches you.
That protection only covers the exact domain. It does nothing against lookalikes, which is why the domain check comes first.
SPF and DMARC in plain words
Three records in a domain’s public DNS let mail services test whether an email is genuine:
- SPF is a list of the mail servers allowed to send for the domain.
- DKIM is a digital signature added to each message, which proves the message was not changed and was sent by the domain.
- DMARC tells receivers what to do when a message fails those tests: nothing (“none”), send it to spam (“quarantine”) or refuse it (“reject”).
You can see the results yourself. In Gmail, open the message, choose “Show original” from the menu, and look for SPF, DKIM and DMARC near the top. A real bank email shows PASS for all three with the bank’s domain. A FAIL, or a PASS for an unrelated domain, means the email did not come from the bank.
Check 3: where the links go
Before you click, find out where a link really goes. On a computer, hover over it and read the address that appears. On a phone, avoid tapping and look for the destination in the text of the message instead. The domain in the link should be the bank’s own domain, read from the right as above. A link shortener, a raw number address or any other domain is a reason to stop.
Treat attachments the same way. If you did not ask for a document, check for it inside online banking instead. An unexpected attachment that asks you to enable content, open a zip file or sign in to view a document is a strong sign of phishing.
What to do now
- Read the domain after the @ and compare it with the table above.
- Do not click links in an unexpected bank email; open the bank’s app or type its address instead.
- Forward suspicious messages to your bank’s reporting address, then delete them.
- If you entered a password or card number, call your bank on the number printed on your card.