"There's a problem with your account"
Listen to this page This recording is of an earlier version of this page.Also in: English · Español · Tiếng Việt · 中文 · Русский · 한국어
This is the most frequently reported scam by Americans over 60. Not the costliest , but the one that arrives most often, in the most disguises.
How it arrives
A text, an email, or a voicemail about a problem:
- A charge you didn't make, reply YES or NO
- Your account is locked or suspended
- Your password is expiring
- A payment failed and your service will be cut off
- Your package couldn't be delivered
- An unpaid toll
- Verify your details to keep your benefits
- Your antivirus subscription auto-renewed for $499, call to cancel
They impersonate whoever you're most likely to have: Amazon, your bank, Netflix, USPS, Apple, Medicare, Microsoft, your electric company, PayPal.
What they want
One of three things, and they're happy with any of them:
- Your password: via a link to a fake login page that looks perfect
- Your verification code, the six digits your bank texts you 3. A phone call from you, which turns into one of the bigger schemes on this site
That third one is the growing version, and the sneakiest. There's no link to inspect and no fake website to spot. Just a phone number and a story. Security advice that's all about "don't click links" doesn't help you here.
The shapes it takes
Same scam, different vehicles. Each shape has its own way of looking harmless.
The fake "verify your account" email
The oldest one, and still the most common. A message that looks exactly like one from a company you use, with a button that says Verify, Confirm, Review, or Update. The button goes to a copy of the real login page. You type your password into the copy, and the copy belongs to them.
The copy is often perfect. Logos, fonts, footer text, even the little unsubscribe link at the bottom are lifted straight from a real email. A page looking right is not evidence. Looking right is the entire product.
The text message
The same thing, shorter, and harder to examine because a phone screen hides most of the address. The package, the toll, and the recall are the three you will see most often, and those have a page of their own.
The spoofed sender
The name you see is not the address it came from. Mail programs show a friendly name, and whoever sends the message picks that name themselves. "Chase Fraud Alert" can sit on top of an address like alerts.chase-security@mail-b7.info.
On a phone this matters more, because the friendly name is usually all you are shown. Tapping the sender name is what reveals the address underneath, and most people never tap it.
The link versus the attachment
A link takes you somewhere. An attachment brings something to you. Both are used, and the attachment is the one people expect less.
It arrives as an invoice, a receipt, a fax, a voicemail, a shipping label, or a court notice, in a PDF, a Word document, or a ZIP file. Some attachments simply hold the same fake link inside, which carries the message past filters that only check links. Others ask you to enable editing or enable content when you open them, and that second click is the one that installs something.
You did not order an invoice you were not expecting. A document that arrives out of nowhere gets the same treatment as a link: leave it closed, reach the company your own way, and ask whether they sent you anything.
The QR code
Newer, and it works because a square of dots gives you nothing to read. There is no address to squint at, so there is no wrongness to notice.
They turn up as stickers pasted over the real code on a parking meter or a charging station, printed on flyers and fake utility shutoff notices, and inside emails as a picture, which slips past software that only inspects links.
Your phone will usually show you the address before it opens anything. Read that address before you tap Open. If it is not the company you expected, close it. And a code that arrives in a message you did not ask for is simply a link in a message you did not ask for. Do not use it at all.
The "was this you?" alert
The cleverest of the set, because it borrows the shape of the message that is supposed to protect you.
"Security alert: your account was accessed from a new device in Dallas, TX. If this was not you, secure your account here."
Nothing has happened. There is no sign-in. The alarm is the bait, and "No, this was not me" is the button they are hoping for, because it leads to a login page that is theirs.
The same trick arrives as a password reset you never requested, and as a verification prompt on your phone that keeps buzzing until you approve it just to make it stop.
Never approve a prompt you did not start. A reset you did not ask for is not a task, it is a notice. Ignore the message, open the account the way you always open it, and look for yourself.
When the link asks you to type a command
A newer trick skips the fake login page. You land on what looks like a "verify you're human" check, and it asks you to press a couple of keys and paste something. That paste is a command the page put on your clipboard, and running it hands your computer to somebody else. Real human checks never ask you to type anything into your own machine. There's more on the fake popup page.
The tells
Every one of these is a reason to slow down and look. None of them is proof, in either direction. A message carrying three of these signs can still be your own bank having a bad morning, and a message carrying none of them can still be a scam. A tell is a signal to go check for yourself. It is never a verdict, and it is never a reason to feel foolish for having believed something well made.
The link is wrong, and the wrongness is small. Real: chase.com. Fake: chase-secure-alerts.com, chase.verify-account.net, chasebank-support.co. Everything before the last dot before the slash can be faked; only the part immediately before the first single slash is the real owner.
Better rule: don't inspect links at all. Don't get good at spotting fakes. Just never use one. Type the address yourself, or use your own bookmark, or your bank's app.
The greeting is generic. "Dear Customer," "Dear Account Holder." Your bank knows your name.
Urgency plus a deadline. 24 hours. Immediately. Or your account closes.
Small errors. Odd grammar, a strange space before punctuation, a logo slightly the wrong color. Note: the good ones have none of these anymore. AI writes clean English now. Absence of errors proves nothing.
The only way forward is inside the message. Every route it offers you, the button and the number and the code and the attachment, lives in the message itself. Real companies are glad for you to reach them your own way. A message that needs you to stay inside it is telling you something.
It arrived out of nowhere. You weren't expecting a package. You don't drive that toll road. You don't have that subscription. Though sometimes you do, they send thousands and some land right.
How to look without touching anything
You do not need this part. The rule below handles every case with no inspection at all. But people like to look, and looking is safe as long as you never tap.
On a computer, hover. Rest the mouse pointer on the link without clicking. The real address appears in the bottom corner of the window, or in a small box beside the pointer.
On a phone, press and hold. Hold your finger on the link for a second instead of tapping it. A panel opens showing the full address, with a Copy option and a Cancel. Read it, then Cancel.
To see the real sender, tap or click the sender name. The friendly name opens up to show the actual address underneath.
Read an address from the right, not the left. Find the first single slash. The two words immediately before it are the owner of the page, and nothing else is:
- chase.com/login is Chase
- secure.chase.com/alerts is Chase
- chase.secure-login.net/verify is secure-login.net, not Chase
- chase-com.info/account is chase-com.info, not Chase
Everything to the left of those two words can say absolutely anything. That is the whole trick, and it is why the fakes read so well.
Now put all of that away. Knowing how to inspect a link is a party trick. Never using one is a defense. The people who get caught are not the people who could not have told. They are the people who were tired, or busy, or in a hurry, and gave it one second instead of five.
What to do
Never use the link. Never use the number in the message.
Instead:
- Open your bank's app, or type the address you already know
- Call the number on the back of your card
- Log in the way you always log in
If the alert is real, it will be waiting for you inside your account. If there's nothing there, there was nothing there.
Never read a verification code to anyone. Your bank sends those to keep other people out. Nobody legitimate will ever ask you to say one out loud or type it into a chat. Anyone asking is standing at your bank's front door trying to get you to hand them the key.
Don't reply to a scam text, even to say STOP. Delete it, or report it by forwarding to 7726 (SPAM), which helps your phone company block the sender.
The three steps, applied to a message
This site has one method, and it works here exactly the way it works on a phone call.
- 1
Look it up yourself.
Not the link. Not the number in the message. Not the address in the signature. Open the app you already have, or type in the address you already know, or use the number on the back of your card.
- 2
Reach the company yourself.
Close the message first, then get in touch your own way, and ask plainly: "I got a message saying there is a problem with my account. Did that come from you?" If the alert is real, it will be waiting for you inside your account. If nothing is there, there was nothing there.
- 3
Wait a day.
Almost nothing inside a real account needs an answer tonight. A real fraud hold, a real overdue bill, and a real recall all survive a night's sleep. The deadline in the message is the one part of it that is reliably fake.
The message wants all three steps to happen inside the message: its link, its number, its clock. Taking any single one of them outside is enough to end it.
If you clicked and entered your password
- Change that password immediately, on the real site, typed yourself
- If you use that password anywhere else, change it there too. This is the real damage. One password, reused, unlocks a whole life.
- Change your email password first if it was the same one
- Turn on two-factor authentication where offered
- Watch statements for three months
You are not in trouble. You typed something into a box. Millions of people do it every year, including people whose job is computer security.
If you opened an attachment
Opening the file is usually not the moment of damage. The damage comes from what it asked you to do next.
- If you opened it and closed it and nothing else happened, you are most likely fine. Delete it.
- If you enabled editing, enabled content, allowed a download, or a program installed itself, run a scan with the security software already on your computer and have someone you trust take a look.
- If you typed a password in order to view the document, treat it exactly like the section above. Change that password, and change it everywhere you reused it.
The one change that makes this stop mattering
Reusing the same password everywhere is why one stolen password becomes ten stolen accounts. A password manager fixes that permanently: it invents a different, harder password for every site and remembers all of them, so you only have to remember one.
You likely already have one, free, built into a device you own. Apple ("Passwords" on iPhone and Mac), Google ("Password Manager" in Chrome and Android), and Microsoft (in Windows and Edge) all include one. You don't have to buy or install anything. Ask someone you trust to help you turn it on and move your most important passwords (email and banking first) into it.
The habit that ends this whole category
Never use a link or number that came to you. Reach the company your own way, every time, without exception.
That's not vigilance and it doesn't require you to inspect anything. It's one habit, and once you have it, this entire category of scam simply stops working on you, today's version and every version they invent next.
Related: Is this text from my bank real? · How they got your information
