Skip to content

Credential phishing

Account Locked Phishing Email

The email claims your account is locked, suspended, or has suspicious activity. The login button leads to a fake page that steals credentials and sometimes OTPs.

if you got this

Treat it as a scam until you check. Don’t click, pay or share a code. Do not click the email button.

Check my message with KavalFree to start. Nothing to install.

what it looks like

Forwarded

Your account has been locked due to unusual activity. Sign in within 24 hours to restore access.

People react quickly when they believe email, banking, work, or social access is at risk.

red flags

  • Sender domain does not match the real service
  • Login button goes to a lookalike or short URL
  • Urgent deadline
  • Requests for password, OTP, backup codes, or recovery email
  • Generic greeting and unusual attachments

if it’s happening now

  1. Do not click the email button.
  2. Open the service by typing the official website or using the app.
  3. Change password if you entered it.
  4. Review sessions, recovery options, and forwarding rules.
Already clicked, paid or shared something?

Don’t

  • Do not paste backup codes into a link from email.
  • Do not trust display names.
  • Do not forward the email to others as a warning without context.

Save this evidence

  • Full sender address
  • Message headers if available
  • URL behind the button
  • Login alerts and session screenshots

Stop it happening again

  • Use a password manager to detect fake domains.
  • Enable 2FA and login alerts.
  • Bookmark important services.

questions people ask

Can an email display name be trusted?

No. Display names are easy to fake. Check the real sender address and destination URL.

What if I entered my password but not OTP?

Change the password immediately from the real site, log out other sessions, and review recovery settings.

Last reviewed 8 July 2026.