Recognising a phishing email
What genuine TDACorp Identity emails look like, how they are built to be safe to open, and the signs that a message pretending to be one is not.
On this page
Phishing is a message that looks like it came from a service you use and tries to make you hand over a password, a code or a click. This page describes what real identity emails look like and how they behave, so you can tell the difference. It cannot catch every fake: when in doubt, do not use the message. Open the sign-in page yourself, from a bookmark or by typing the address, and check your account there.
How genuine messages are built#
All identity emails come from one layout. These traits hold for them. Emails follow the language saved on your profile (English, French or Spanish), so the wording below, shown in English, reaches you in that language. See Languages.
- The header is the wordmark TDACorp IDENTITY.
- The footer is one of two fixed sentences. One is You are receiving this because of activity on your TDACorp Identity account. The other, used for sign-up mail to an address that may have no account, is You are receiving this because this address was used to start sign-up or sign-in at TDACorp Identity. If it was not you, ignore this email.
- Each message has one purpose. Its button label matches what it does.
- The message states an expiry. Links and codes name the time they expire and say they work once.
- Opening a link changes nothing. A link in an identity email opens a page that asks you to confirm. Your sign-in, recovery, cancel or revert happens only when you select the button on that page, which keeps a mail scanner that previews links from acting for you. The pages say so: Opening this page does not sign you in. Only the button below does.
- A sign-in link or recovery link asks you to use the same browser you started in.
A fake can copy a layout, so these traits help but do not prove a message is real. What proves it is what the message asks you to do.
The messages you may genuinely receive#
| Subject | Why you get it | Button, if any |
|---|---|---|
| Verify your email address | Someone added this address to an account. It has a code and an Open your profile button. | Open your profile |
| Your account recovery is on hold | You asked for recovery again while a hold was running. It has no link. | none |
| A role was granted to you in ... and A role was removed from you in ... | An administrator changed your roles in an organization. | Review your account |
| A support engineer is accessing your account and A support access window for your account has closed | Support access to your account started or ended. | none |
| Confirm your email address | You started creating an account. It has a link and an eight digit code. | Confirm your email |
| You already have an account | Someone, possibly you, tried to register an address that already has an account. | Sign in |
| Your TDACorp Identity sign-in link | You asked for an emailed sign-in link. It has a link and a code. | Continue signing in |
| Your TDACorp Identity sign-in code | You turned on the emailed code as an extra step and just typed your password. It has only a code, no link. | none |
| Your TDACorp Identity sign-in code (your passkey was skipped) | You typed your password and chose Email me a code instead because you could not use your passkey. It has a code and a Secure my account button. | Secure my account |
| A sign-in skipped your passkey | Sent to your other verified addresses when that emailed code is requested. | Secure my account |
| Confirm this sign-in to TDACorp Identity | A sign-in looked different from your usual ones. | Review this sign-in |
| New sign-in to your account | A sign-in from a new device. | Review this sign-in |
| Security alert: ... | A change on your account, such as a password or passkey. | Review your account |
| Your account was secured | You chose No, secure my account. | Sign in, Start recovery |
| Recover your TDACorp Identity account | You asked for recovery. | Start recovery |
| Account recovery started: cancel it if this was not you | A recovery with a wait began on your account. | Cancel recovery |
| Your primary email was changed | Sent to the old address after a change. | Revert the change |
| A recovery code was not accepted | A recovery attempt used a code that did not match. | none |
| You have been invited to ... | An organization invited you. | Accept the invitation |
Treat any message in this list that you did not trigger as a signal, not as an instruction. Those you did not start can mean someone else typed your address, which is harmless on its own, or that something is happening on your account. What a security alert email means explains how to read each.
Signs of a fake#
- It asks for your password, a recovery code or an authenticator code. Identity never does this by email. See What identity never asks for.
- It builds urgency. A threat that your account closes today pushes you to act before you think. The real messages say what happened and offer to review.
- The sign-in or confirm page it leads to looks real but the address bar is wrong. The page must be the TDACorp Identity address you normally use. Check the whole address, not just the start.
- It arrives when you did nothing. A sign-in link you did not ask for may be someone typing your address. Do not open it.
- It asks you to install something, call a number or reply with details.
- It attaches a file, or asks you to open a shared document. Identity messages are a short text with a button, and none is built to carry an attachment.
- It asks you to read a code back or pass it on. A code is for you only. The sign-in code email says: do not share this code.
What to do with a message you doubt#
- Do not select any link or button in it.
- Open the sign-in page yourself and check Notifications and Devices under your account for anything unexpected. See Notifications.
- If the message is a sign-in link or code you did not request, ignore it. The message says nothing changes unless the link is confirmed or the code is typed.
- If you already selected something or typed a secret, treat it as a possible takeover.
- To report a fake, see the security contact on Reporting a vulnerability.
What your own habits do#
- Use a passkey. A passkey does not work on a fake page, so a phisher gets nothing from it. See Passkeys and passwords.
- Go to the site yourself. Bookmark the sign-in page and use it, instead of following links from mail.
- Slow down on anything that asks for a secret. Even an email that looks perfect does not change what identity never asks for.
What this page cannot tell you is whether a given message passed email authentication checks. Your mail provider shows that, and the platform does not publish details of its sending setup here.