How do I spot a fake 'account verification required' email?
Fake account verification emails create urgency about account suspension and link to credential-harvesting pages — verify your account status by typing the site address directly, never via a link.
Last reviewed: 10 June 2026
Explanation
Account verification phishing is one of the most versatile attacks because it can be applied to almost any service: banks, email providers, social networks, streaming platforms, e-commerce accounts, or cloud storage. The email says your account requires immediate reverification due to suspicious activity, a policy update, new security requirements, or an unconfirmed detail.
The urgency is calibrated to be just uncomfortable enough to prompt action without triggering scepticism: 'your account will be restricted in 48 hours', rather than 'your account will be deleted in one hour'. The link leads to a convincing replica of the service's login page, and sometimes also mimics a verification form that collects additional personal details.
Identifying clues: the sender email address domain does not exactly match the service; the link destination shown on hover does not match the official domain; the form asks for more than just username and password (security questions, payment card details, date of birth); and your password manager does not autofill the credentials.
For any account concern, the correct action is to navigate to the service by typing its address or using a saved bookmark, log in, and check whether a genuine notification exists in your account dashboard. If nothing is shown there, the email was phishing.
Common red flags
- Sender address does not match the official domain of the service
- Link goes to a domain other than the official service URL
- Form asks for more than username and password — card details, answers to security questions
- Password manager does not autofill credentials on the linked page
- Account notification does not appear in your actual account dashboard
- Generic greeting rather than your registered name
What to do now
- Do not click the link — navigate to the service by typing its address
- Check your account dashboard for any real verification request
- Report the phishing email to the service using their official abuse address
- Forward UK phishing emails to [email protected]
- If you entered credentials, change your password immediately and enable 2FA
Frequently asked questions
Why do services need to verify my account?
Legitimate verification is triggered by specific events: a new device login, a change to your details, or a new regulatory requirement. It appears in your account notifications, not only in an email.
What should I do if I genuinely need to verify an account?
Log in directly at the service's official URL, navigate to account settings or security, and complete any genuine verification steps there.
Can two-factor authentication stop this type of attack?
2FA significantly raises the bar for attackers but does not eliminate risk from real-time phishing attacks. Avoid entering OTP codes on pages you reached from unexpected emails.
Sources
- FTC — Tech Support Scams — Federal Trade Commission
- CISA — Avoiding Social Engineering and Phishing Attacks — Cybersecurity and Infrastructure Security Agency
- FCC — Frauds, Scams and Alerts Guides — Federal Communications Commission
- AARP — Fraud Watch Network — AARP