'Your Email Will Be Deleted' IT Phish
A fake IT or provider notice warns your mailbox will be deactivated or deleted unless you 'verify' now, linking to a page that steals your login.
Think a message like this reached you? You can check it right now.
What this scam is
You receive a message that looks like it's from your IT department or email provider, warning that your mailbox is over quota, being deactivated, or will be deleted unless you verify or reactivate within a deadline. The link opens a fake login that captures your credentials. Fear of losing email prompts fast action. Real IT and providers manage this within the system and don't ask you to verify your password via an outside link.
What it usually looks like
- A 'mailbox will be deleted/deactivated' warning.
- A 'verify/reactivate now' link and deadline.
- A fake login page.
- Sender that appears internal but is spoofed.
Common warning signs
- Threats to delete your email unless you verify.
- Login links to non-official addresses.
- Deadlines and urgency.
- Requests to re-enter your password.
Example wording scammers use
“IT Notice: Your mailbox has exceeded its limit and will be deactivated in 24 hours. Verify now to keep access.”
“Reactivate your email account to avoid permanent deletion: mail-reactivate-portal.net”
These are illustrative examples written by ScamSplain, not real messages.
What the scammers want
- Your email login.
- Access to your mailbox and connected accounts.
- Reusable credentials.
What to do
- Verify with your IT/help desk through known channels before clicking.
- Don't log in from the email's link.
- Enable two-factor authentication.
- Report the message to IT/security.
What to do if you already responded
- Change your password and revoke sessions; tell IT.
- Check for new forwarding rules.
- Report at reportfraud.ftc.gov.