Account suspension / verification

Spoofed Afterpay account-status emails leading to a fake login page and a one-time-code form. A 2025 twist: genuine Afterpay emails about an account someone opened in your name with a phone number that is not yours — the wrong phone number is the linchpin of that variant.

A 2019 wave of emails with a spoofed account-alert@amazon.com sender: "your account settings have been changed", a report ID, and a link to a fake Amazon login form. Some copies carried a Word attachment instead of a link.

A receipt for an iTunes purchase you never made, around $200, with the line "if this wasn't you, your account has been compromised" and a link to cancel. The cancel page is the phishing form.

An email that looks like a DocuSign envelope notification with a "Review document" button. The button leads to a login page that steals the email password, or to a file download. DocuSign asks for copies at spam@docusign.com.

Emails saying your Netflix account is suspended or your payment could not be processed, with a link to "update" billing details on a look-alike page. Netflix documents the pattern and asks for copies at phishing@netflix.com.

A "thank you for booking" email with a reference number and a link to "view the details of this request". No booking exists; the link leads to a page that collects personal details or serves a download.

Two waves aimed at Telstra customers in Australia: fake bills and a "you paid twice, claim your refund of $202.42" email (2016), then a BigPond "your service could be suspended, update your billing information" email (2017). Both lead to a copy of the My Account page that collects logins and card details.