Scam library
Fake sign-in pages
A link to a shared document, voicemail or message that leads to a fake page to steal your password.
Talked about today116K interactions
TrendSteady
Last 14 days
Social interactions on posts about "phishing email", from LunarCrush.
What it looks like
Jordan shared a document with you: "Q4 Invoice.pdf". Click to view. You may need to sign in with your email account.
You have 1 new voicemail (0:42). Listen now: voicemail-portal.example.com
Your mailbox is almost full. Sign in to keep receiving messages: mail-upgrade.example.com
How it works
The email looks like a normal notice from a work or email account. The link goes to a page that looks exactly like a real sign-in screen. When you enter your password, and sometimes the code from your phone, they log into your real account and use it to read your mail, reset other passwords or scam your contacts.
The tells
- A shared file or voicemail you were not expecting
- A sign-in page that appears after clicking an email link
- The address bar shows a web address that is not the real company
- Your password manager does not offer to fill in the password
- Urgent tone: mailbox full, document expires, payment pending
If you got one
- Do not sign in from the link. Go to the site directly or use its app.
- If it seems to come from someone you know, check with them another way.
- Report it using your email app's Report Phishing button.
- Use passkeys or a password manager. They will not fill in on a fake site.
If you already paid or shared something
- Change that password right away, and on any account that used the same one.
- Check your email settings for forwarding rules or recovery details you did not set.
- Sign out of all sessions and turn on two-step sign-in or a passkey.
- If it was a work account, tell your IT team now.
Who gets targeted
Office workers, small business owners and anyone with an email account.
Related: What is a passkey and should I use one?
Kit: The Ten-Minute Kit