Most people think email from a bank can't be faked. It can.

There's a setting called DMARC. It tells inboxes what to do with mail that pretends to be from a company. It has three options: block it, send it to spam, or do nothing.

Gmail's rules for big senders say a company has to have DMARC. But the setting is allowed to be "none," which means do nothing. That still counts as following the rules.

So a bank can be fully compliant and someone can still send you fake mail in its name.

Don't click links in bank emails. Open the app yourself.

Source: Google, Email sender guidelines (in force since Feb 1, 2024); CISA BOD 18-01 on p=none vs p=reject.