The message begins example.com wants you to sign in with your Ethereum account: followed by the address, an optional statement and the fields URI, Version (1), Chain ID, Nonce (at least 8 alphanumeric characters), Issued At, and optionally Expiration Time, Not Before, Request ID and Resources. Wallets compare the domain with the requesting origin to warn about phishing.
The server must check everything, not only the signature: that the domain and URI are its own, the nonce is one it issued and has not seen, the times are valid and the chain ID is expected. EOA signatures are verified per EIP-191; contract accounts through ERC-1271 on the stated chain. The SIWE verifier runs these checks.