Amidst the pandemic, the surge in unsolicited scam emails has made internet technology a significant concern. Distinguishing between scams and authentic/legit emails has become increasingly difficult. This research aimed to identify typical characteristics and language patterns found in emails. It also aimed to identify the common linguistics and technical features of the scams and legitimate bank emails. Two legitimate emails and two scam or fraudulent emails from different banks in the Philippines (i.e., LandBank and BDO). A qualitative method was used to analyze and interpret the language features of the two emails. This led to the identification of shared characteristics found in scams and legitimate emails. A scam email typically includes embedded malicious links, misspellings, formatting issues, suspicious email domains, frequent use of contractions and redundancy, tautology, and imperative mood. On the other hand, legitimate emails exhibit proper punctuation, accurate email domains, appropriate formatting, absence of spelling mistakes, avoidance of contractions and redundancy, and use indicative mood rather than imperative. Scam emails utilize modal verbs to manipulate recipients into divulging personal information. Recognizing these email patterns is crucial for educating users and reducing phishing risks. It is important to note that the interpretation and findings of this study are based on the entire dataset collected. Keywords: Bank Emails, Legit Emails, Linguistic Features, Scam Emails, Phishing