Password expiry scam email: fake "your password expires in 24 hours" notice from your email provider

Reported as phishing

This email was reported as phishing in November 2026. It pretends to come from your own email provider. It was aimed at International and written in English.

This email was reported as phishing. It uses a made-up or generic sender to win your trust.

This email pretends to come from your own email provider. It puts your domain name in the heading and your email address in the text, so it looks like an internal notice. It says your password will expire in 24 hours and that you could be locked out, then offers a "Keep Current Password" button. The button leads to an unrelated website, and the sender address is not your provider's.

Seeing your own domain and address makes the email feel internal, and a lockout within a day pushes you to act fast. The best tell: A real password change is done in your account settings, not through a button in an unexpected email. Your own address shown inside the button is another sign the link was built for you.

• Aimed at: International
• Month reported: November 2026
• Email language: English

What the email looks like

Re-typed from the original with personal details removed. This is not the original email. This was a button in the original email. Here it is only a picture of the text and does nothing.

Subject line

• confirm your access
• Webmail [your domain]: Your email password will expire in 24 hours

Red flags

• Uses your own domain name in the text to look internal
• Sender address is not your provider's
• 24-hour deadline and lockout threat
• "Keep Current Password" button leads to an unrelated website
• Your email address is shown inside the button / link

Links in the email (shown as plain text)

Links are defanged: "hxxp" and "[.]" stop them from working. Never retype them or copy them into your browser.

What to do

1. Do not click the "Keep Current Password" button or any link in the email, and do not reply.
2. Do not open attachments. Never type a password, card number or code on a page you reached from this email.
3. If you are unsure, open your webmail yourself by typing its address or using your usual app, not through the email.
4. A real password change is done in your account settings, not through a button in an unexpected email. Change your password only from your own account settings.
5. Mark the email as phishing or spam in your mail app, then delete it. If you work at a company, tell your IT team.
6. If you already entered your password, change it now and turn on two-step sign-in. Contact your bank if you shared card or bank details.

How to report it

In your mail app, use "Report phishing" or "Report junk" so the app learns to block similar emails. You can also forward the email to the real company's abuse or security team, using an address from its official website. If you lost money, report it to your bank and to your local police.

More scam email examples

• German police: Fake summons - answer within 72 hours
• Spotify: Payment problem / update your payment details
• Atatürk University: Email access update required - log in to keep your mailbox

These emails did not come from the companies or services they name. Brand names belong to their owners and are shown only to help you recognise the scam.