‘Email Account Pending Deactivation’ Phishing Scam

Outline

Email purporting to be from the “Mail Administrator” claims that the user’s email account is pending deactivation and will be terminated within 24 hours if the user does not click a link to sign in and update the account.

Brief Analysis

The message is not from any genuine Mail Administrator and the claims of impending account deactivation are untrue. Instead, the email is a phishing scam designed to trick unwary users into giving their email account login details to cybercrooks.

Example

Detailed Analysis

This deceptively simple phishing email attempts to panic unwary users into sending their email account details to cybercriminals.  The email, which purports to be from the Mail Administrator, claims that the user’s account is “pending de-activation” and will be terminated within 24 hours unless the user provides an account update. The user is instructed to click a link to begin the update and save his or her account from permanent deactivation.

Those panicked into clicking the link in the message will be taken to a generic webpage that asks them to login with their email address and email account password.

Thus, believing that they have successfully saved their accounts from deactivation, users may go about their business with no inkling that they have just been scammed.

Unlike many other email phishing scams, this one does not target customers of a specific email provider. It deliberately does not mention the name of the email service provider that the message was supposedly sent by. In this way, the scammers can collect account data from users of any email system.

Once they have harvested the account details, the criminals can then hijack the real email accounts belonging to their victims and use them to launch various spam and scam campaigns.

Be cautious of any unsolicited email that claims that you must update your email account by clicking a link or opening an attachment. Such “account update” scam emails are a very common scammer ploy.