Email and phishing scams
The “your account is locked” phishing email
An email says your bank, email, streaming, or shopping account has been locked or suspended because of suspicious activity or a billing problem, and asks you to sign in through a link to fix it. The link leads to a fake sign-in page that sends your password to the scammer.
This is one of the oldest phishing tricks, and it still works because it turns a security feature into the bait. The email borrows the company’s logo and colors, so the design looks right. What gives it away is what it asks you to do.
What the email looks like
How to spot it
- It wants you to sign in through its link. The FTC notes that legitimate companies won’t email or text you a link to update your payment information. When in doubt, sign in through the app or a bookmark instead.
- The sender’s address doesn’t match the company. Look at the full address, not just the display name. “Microsoft Account Team” sending from
account-security-alerts.cois not Microsoft. - The link goes somewhere else. On a computer, hover over the button to see where it really goes. A real company’s name buried inside a longer address, like
login-microsoftonline-verify.com, is a common trick. - It sets a deadline. “Within 24 hours or your data will be deleted” is pressure, not policy.
- It has a generic greeting, like “Dear user” or “Dear customer”, instead of your name.
- It mentions activity, a bill, or an invoice you don’t recognize.
Got a message like this? Check it
Paste the text, email, or link below. The check runs in your browser, and nothing you paste is uploaded.
Pick a sample or paste your own, then press Check it.
What to do
- Don’t click the link or open attachments.
- Check the account yourself. Open the company’s app, or type its address into your browser, and sign in there. If there really is a problem, you’ll see it.
- Report the email. Use your email provider’s “Report phishing” option, and forward the email to the Anti-Phishing Working Group at [email protected]. You can also report it at ReportFraud.ftc.gov (opens in a new tab).
- Delete it.
If you already typed your password into the page, change it now, first on that account and then anywhere else you use the same password, and turn on two-step verification. I clicked a scam link: what to do now walks through the rest.
Sources
- How to recognize and avoid phishing scams (opens in a new tab) Federal Trade Commission
- Recognize and report phishing (opens in a new tab) Cybersecurity and Infrastructure Security Agency
- What to do if you were scammed (opens in a new tab) Federal Trade Commission