In brief: before opening an attachment, check that the email relates to your booking. A sender name, logo or correct route does not authenticate it. If unsure, open the seller's website independently and verify through an official channel.
Why even a post-payment email needs checking
Expecting a ticket makes it easier to trust a message and overlook a different link or someone else's file. Several purchases or helping relatives complicates checks. Keep your booking number, date, route and seller contact separately.
Match the message to a purchase rather than just a subject such as “Your ticket”. Subjects can repeat, and a display name is not the full sender address.
Four initial checks
Compare the reference, passenger, date and route with the purchase confirmation. Do not open another person's or date's attachment out of curiosity. It could be misdelivery, an unrelated booking or a suspicious message. Use a seller contact you already know.
Inspect the full sender address and actual link destination, not just “RedRay” or its logo. Even a plausible address does not make every file safe. Complete verification on the official resource or with support.
Attachment formats matter
Do not install software or a browser extension merely to read a ticket without clear seller confirmation. Requests to run a file, disable protection or allow unusual actions deserve particular caution. You need the prescribed boarding document, not unknown software.
Check the full filename rather than its icon: multiple extensions can disguise the type. A password-protected archive is not proof of safety. Ask for an official resend or account access if unclear. Even PDF does not guarantee authenticity.
“Pay now or your ticket will disappear”
Establish whether the booking is paid and why more money is requested. Do not copy emailed payment details straight into your bank app. First check the order in your account or through a previously verified contact.
Knowing the exact service does not prove authority. Never disclose passwords, banking codes or card security codes to “activate boarding”. A genuine extra service should have clear arrangements, an amount and a link to your booking.
Verify without using the suspicious link
Use a trusted bookmark or type the website address. Check the order; without an account, use the contact from your purchase confirmation. Ask whether they sent that reference and attachment and which boarding document is required.
A support button inside the questionable email may lead to the same outside source. Verify contacts independently. The National Cyber Security Centre also advises checking suspicious requests and taking care with the actions they demand.
Tickets for relatives
Share the verified current file, not an entire email history saying “the ticket is somewhere here”. That history may contain receipts, old versions and other services. Ask the traveller to open it and identify the date, route and passenger.
Agree not to act automatically on boarding changes or extra-payment demands: verify with the buyer or official support first. Mark the current printout and provide a verified phone contact. Do not print secret banking details alongside it.
If the file was already opened
Reading an email, downloading, running software and entering a password are different events. Recall what happened and stop interacting with the source. If software was installed or the device behaves unusually, seek manufacturer support or a trusted specialist and avoid further payment on it until clarified.
If payment details or a banking code were shared, contact the bank immediately through its official channel. Change an exposed email or account password through the real service and review security options. Do not disclose it to somebody offering to restore access.
Organise documents before departure
Save the verified ticket offline, separate from old versions, while retaining change confirmations. Check that it opens without logging into email again. This avoids a rushed search for an unverified attachment before boarding.
Resending without confusion
Ask whether a resend contains the same ticket or a reissued version. After a change, one file may be outdated; arrival time alone does not establish validity. Confirm the current booking details.
Name the file by date and route without editing its contents or cropping the code. Explain to relatives which version to show. Ask for an authorised alternative if the format is inconvenient.
Do not share your whole inbox
Send the verified file or arrange official delivery instead of sharing an email password. The inbox may contain unrelated purchases and personal or banking records. If somebody helps with your phone, retain control and do not reveal bank codes: ticket viewing does not require payment access.
A forwarded conversation may hide the original sender. A relative's name identifies who forwarded it, not who created the file. Verify the reference as you would your own. Do not manually replace another passenger's name; obtain an officially issued ticket.
To test offline access, close the mail app and reopen the saved document. If it asks to download again, saving is incomplete. Fix this before travel using the verified file.
Questions and answers
Does a familiar logo authenticate the email?
No. Match the booking and address and use an independently found official contact if unsure.
Can I run an unknown file to see a ticket?
Not without verification. Confirm the prescribed format or obtain an official resend.
Is a PDF always safe?
No. The format proves neither source nor contents. Check the purchase and keep software updated.
What about an urgent extra-payment demand?
Check the status and reason with the seller. Do not pay solely because an email threatens your seat.