Let's take a good look at the clues in this example that pretends to be a subscription confirmation to Norton LifeLock. 1. The sender address. The sender's email address is often the first clue that the message is a fake. In this example they haven't even tried to make it look real.