E-Mail Deactivation Scams

No, Your E-Mail Account Is NOT About to be Closed

Account Closure E-Mails are Another Form of Phishing

 

Account Deactivation E-Mails

Have you received an e-mail stating your ISP is going to deactivate your e-mail account? Did you panic?  Well, you can relax, as these "Account Closure" e-mails are just another form of phishing, and they can safely be junked.

To review, phishing is a form of spam. in which the bad guys try to steal your personal information by impersonating someone trustworthy.  We've talked about phishing many times in the past.  The Bad Guys use sophisticated tactics to try to separate you from your personal information, often so they can impersonate you and/or steal your identity.  E-mails threatening to close your e-mail account if you do not click on a link are no different.

These e-mails are designed to make you freak out.  If you click through the inline links, you'll most likely be brought to a fake log-in page.  This page may spoof GMail, yahoo, apple, or any number of e-mail providers.  However, often they will bring you to a spoofed Cpanel Webmail log in page,  like the one pictured below.  After you enter your e-mail credentials, you'll most likely be brought to a form asking you to enter additional information.  It will most likely ask you to reset your security questions and answers.  Even if you get wise before submitting the follow-up form, it is already too late.  When you logged in, they obtained your e-mail credentials, and this is enough to lock you out of your own e-mail account.  

Once they have your e-mail username and password, they can read all of the mail in your account.  Chances are, this will include banking correspondence, shopping confirmations, insurance information, and much more.  With that information, and control of your e-mail, they can request password resets for all of your associated accounts, preventing you from accessing those as well.  Suddenly, you find yourself locked out of your online banking, your credit card account, Amazon, EBay, and even Facebook.  And you can't get into your e-mail account to see how much damage they are doing, as they've changed the password and account recovery information for that as well.

You've Exceeded Your Data Allocation

A variation on this scam tells you you've exceeded your data limits and need to request additional mailbox space.  These e-mails always contain a link you are told to click through to protect your account.   Again, these are not usually legitimate, but rather are an attempt to separate you from your personal data.

Mailboxes do fill up, and free accounts very often have tight limits on storage space.  Many times, you are able to purchase additional e-mail space for a fee.  Sometimes, you can get more space on a free server by referring your friends or by sharing the service on Social Media.  But I do not know of any free service that will upgrade your plan for nothing.  If a free provider offers an upgrade, there WILL be hoops through which they will make you jump.  Furthermore, if a free service IS offering upgrades, there WILL be some sort of press about it. At the very least, you'll see an announcement on their website's Home Page. Usually a Google Search will bring up recent articles about the free upgrade as well.  In other words, a free upgrade on a free web service will never come out of the blue, or from a single, short, non-detailed e-mail.  If the first you hear about a major upgrade to a free service comes in a sketchy-looking e-mail, you can be pretty sure it is a scam.

Signs That E-Mail is a Scam

The same signs that apply to other phishing scams apply to e-mail account related spam.  Usually the "From" address is a big clue.  If you look at the graphics in this article, you will see BOTH of the sample Phishing e-mails come from ict.com.  Yet my e-mail is NOT hosted by ICT.com.  Why would another ISP be contacting me about a mail account they do not host?

Next, if I hover my mouse over the links, I can see that they do NOT point to my ISP.  They do not point to ICT.com either, even though they supposedly sent me the e-mail.  Instead, the link points to dmconsultingengineers.com.au, an Australian domain that has nothing to do with e-mail hosting.

The bad grammar, lack of ISP logos, and generic signatures are additional warning signs.  And the fact that I administer my own server is a huge clue for me.  E-mails regarding server issues, including mail, come from my hosting company, and they include the server name.  If you purchase e-mail hosting associated with a domain name, all mail related to issues will come from that hosting company (or domain registrar.)

Legitimate Over Quota Notices

Mailboxes DO fill up, and providers DO send out "over quota" notices.  Usually, the system will generate an over quota notice when you have reached about 80% of your storage capacity. They will continue to send such notices until your mailbox is full.  If you have e-mail hosting associated with a domain name, chances are it will look identical to the one pictured above.  The major free e-mail providers, like Google, Yahoo, Apple, etc., send similar over-quota notices.  Your ISP will also send over quota notices with similar language.

If you'll notice, a legitimate over quota notice does NOT ask you to click on a link.  Instead, it tells you to clean up old mail to make space.  It also says you may contact an administrator to request an account upgrade, rather than asking you to click a link to do so.  Over quota e-mails from Apple may include information as to how you may pay to increase storage space by upgrading your iCloud account.  However, a legitimate over quota notice will NEVER ask you to click through a link.

What if I Think the E-Mail is Legit?

If you receive an e-mail related to your own e-mail account, and you think it may be legitimate, still take the precaution of not clicking through. Instead, open a web browser and navigate to your e-mail host's webpage.  Look for a link that says "Help," "Support," or "Contact Us."  Navigate to that page of the website. If there are any issues with e-mail, steps you need to take to secure your account, or changes that need to be made, chances are you will see an announcement related to this on the e-mail host's webpage.  You may also see a warning about phishing e-mails on the website, especially if a lot of customers are the target of e-mail phishing scams.  

If the e-mail account is part of your Internet Services Package, you should be able to find an e-mail address or phone number to contact Support.  If you have any qualms whatsoever about deleting that account deactivation e-mail, note the e-mail address for technical support, and forward that e-mail to them, asking if you need to do anything.  They will most likely respond quickly that you should ignore the threatening e-mail.

Free e-mail providers do not have great support. You may or may not find an address to which you can forward that questionable e-mail.  "abuse@provider.com"  or "spoof@provider.com" usually works for suspected phishing e-mails.  Be aware you will probably not get a response for several days, if at all.  You can also Google "Account deactivation [provider]."  Again, if a free provider is really deactivating accounts, a Google search will usually confirm this.  If Google turns up nothing, you can safely delete the e-mail, figuring you were just being phished.

To repeat, 99.9% of e-mail deactivation mail is not legitimate. And if there is an issue with your e-mail account, the provider will send out multiple notices, all with their official logos, and all coming from an e-mail address hosted at their domain.  However, just because an e-mail has official looking logos, you cannot assume it is legitimate.  But generic e-mails with no logos is almost always a sham.  In other words, if the e-mail has the graphics and formatting to look like it came from who it says, scrutinize it carefully before assuming it is the real thing. But if it lacks graphics and logos, and just looks like something is off, don't even bother taking the time to examine it closely; just delete the e-mail and move on.

What Should I Do if I get an Account Deactivation E-Mail?

If you get an account deactivation e-mail, you need to scrutinize it carefully.  You should NEVER click through a link contained in such an e-mail, even if you suspect it may be legitimate.  When in doubt, contact the provider the deactivation e-mail is supposedly from.  But in most cases, that e-mail will have signs indicating it can safely be ignored.

99.9% of these account deactivation e-mails are blatant attempts to steal your information, and as such, are e-mails that should be deleted with no further thought or action.  Especially if the e-mail is generic, contains grammatical errors, or contains no logos at all, you can be sure it's junk, and it can be safely spam-filed.  Do not reply, hit unsubscribe, or do anything else to clue in the spammer that you actually received the e-mail.  If you must do anything, you can forward it to the abuse department of your e-mail provider, for their own records.  But chances are, the e-mail provider will take no action other than informing you not to respond to the e-mail in any way, or to click through its links.  

Summary

Did you get a notification your e-mail account is going to be deactivated? Are you worried?  Well, you can relax, as most likely, it's just another piece of Spam.  Scaring people into thinking they'll lose access to their e-mail is just the latest ploy the Bad Guys are using to try to steal your personal information.  This particular scam is attempting to lock you out of your own e-mail account, so the Bad Guys can take it over, and by extension, break into the accounts you have associated with that e-mail address.  They are trying to steal your e-mail credentials so that they can lock you out of your own accounts.

If you receive any type of notification about your e-mail account, scrutinize it carefully.  Chances are, it is a phishing e-mail, rather than a legitimate communication from your e-mail provider.   Do not click through, but rather just delete the e-mail and move on with your life.  No good ever comes from clicking through spam.

Have you received any of these dire-looking e-mails?  Or even worse, received a scam robocall telling you you were about to lose access to your e-mail? How did you handle it? We'd love to hear about your own experiences. Hit us up in the comments section here, or on Facebook or Twitter and let us know.  And as always, thanks for reading