Utility Autopay Enrollment Scam via Email
Phishing emails disguised as utility company notices push recipients to 'update' or 'enroll in' autopay, harvesting bank and card details on a fake billing portal.
Part of: Utility Autopay Enrollment Scam
Last reviewed: 5 July 2026
Utility companies send routine billing emails constantly, and most of the ones in your inbox are real, which is why an autopay notice attracts so little scrutiny. This scam slips into that flow: a message in the utility's branding claims your account is being switched to mandatory autopay, or that a failed payment requires immediate re-enrollment to avoid a late fee or disconnection. The linked billing portal is a near-perfect visual copy of the real login page, harvesting account numbers and bank or card details, and victims often discover it only via an unauthorized withdrawal. The distinction that matters most: enroll in autopay only by typing your utility's website address yourself, never through an emailed link, however routine it looks.
How this scam works on Email
The email mimics a utility provider's branding and claims the recipient's account is about to be switched to mandatory autopay, or that a recent payment failed and autopay must be re-enrolled immediately to avoid a late fee or service interruption. A link leads to a lookalike billing portal that closely copies the real utility's login page, prompting the victim to enter their account number, bank routing and account number, or card details to 'complete enrollment.'
Because the fake portal is often a near-perfect visual copy of the real one, victims frequently do not realize anything is wrong until they notice an unauthorized withdrawal from their bank account or unexpected recurring charges appear, at which point the scammer has already had the account details long enough to make multiple withdrawals or sell the information to other fraud rings.
Common red flags
- The email claims autopay enrollment is mandatory or a recent payment failed and demands urgent action
- The link goes to a domain that does not exactly match your utility provider's real website address
- The page asks for full bank routing and account numbers or card details to 'complete' autopay setup
- Generic greetings like 'Dear Customer' rather than your actual name and account number
- Urgency language threatening late fees or service disconnection within an unusually short window
- Spelling, grammar, or formatting inconsistencies compared to genuine utility company emails
How to protect yourself
- Do not click links in unsolicited utility emails; log into your utility account by typing the official website address yourself
- Verify any claimed failed payment or autopay change directly through your utility's official app or phone line
- Never enter full bank account or card details on a page reached via an email link rather than a bookmarked, verified site
- Check the sender's email domain carefully for small misspellings or extra characters
- Enable account alerts with your real utility provider so you are notified directly of any billing changes
- Report suspicious emails to your utility provider's official fraud or security contact
How to report it
- Report the email as phishing through your email provider's built-in reporting tool
- Forward the email to your utility provider's official fraud or security department
- Report the incident to your national anti-phishing or cybercrime reporting service
- Contact your bank immediately if you entered account details, to monitor for and dispute unauthorized withdrawals
Frequently asked questions
Would my real utility ever tell me by email that a payment failed?
They may occasionally notify you of a failed payment, but a genuine notice would direct you to log into your account through the utility's official app or website rather than a link embedded in the email itself. When in doubt, go to the utility's site directly instead of clicking through.
I only entered my account number, not bank details — am I still at risk?
The risk is lower than if you'd entered bank or card details, but an account number can still be used to attempt account takeover or targeted follow-up scams, so it's worth monitoring your utility account for unusual activity. Consider changing your online account password as a precaution.
What's the safest way to actually set up autopay?
Log into your utility account by typing the official website address yourself or opening their verified app, rather than following any link from an email. Setting up autopay this way ensures your bank details go directly to the real provider.
How can I tell a utility autopay email is fake?
Check the sender's domain and the link destination carefully against your utility's real website, and when in doubt, log in by typing the address yourself rather than clicking the email link.
What should I do if I already entered my bank details?
Contact your bank immediately to flag the account for monitoring, consider changing your online banking password, and watch your statements closely for unauthorized transactions.