Online Threat Alerts (OTA) - Alerting you to scams and frauds.

"American Express Protection Service Case" Scams
American Express Protection Service Case Scams

The email message below which appears to be a fraud protection alert that claims the recipients should secure their accounts by reviewing recent activities is just one of the many phishing scams created by cybercriminals to trick American Express customers into clicking on the link within it. The link goes to a phishing website (a fake American Express website) that steals online account credentials when visitors attempt to sign into it.

American Express cardholders are asked never to click on a link in an email message to access to their accounts. They should instead, go directly to American Express website (www.americanexpress.com) and sign into their accounts from there. If there is something wrong or there is something that they need to with their accounts or cards, they will be notified after signing in.

The "American Express Protection Service Case" Scam

From: American Express Protection Service Case 02951 <aexpcase02951@aexrewardsinfo.net>

Date: December 16, 2017 at 3:45:40 PM EST

To: undisclosed-recipients:;

Subject: Urgent: Please view your recent activity and we'll help you take corrective action. #From IP 189.209.100.109

For your security, we regulary monitor accounts for possible fraudulent activity.

Please read your secure message by opening attachment (pdf). You will be prompted to open

(Visit My Account ) file or save (download) to your computer.

18

Comment sectionComments / Answers (18)

Remove sensitive information from your post. Your IP address will be used to display your estimated location.

Comment count 18

by an anonymous user from: Little Rock, Arkansas, United States

Received this scam:

"From: American Express Protection IB#03132
Sent: Sunday, June 3, 2018 12:24 PM
Subject: Fraud Protection - Please view your recent activity and we'll help you take corrective action.RE#030405

Please read your secure message by opening attachment (pdf). You will be prompted to open ( Visit My Account ) file or save (download) to your computer"

Delete

by info

Here is another scam:

"From: Amex IB Service. Case 0343526 [mailto:a500f21cyzu0343526-aexpinfomembershipsvc.net]
Sent: Sunday, March 18, 2018 2:33 PM
To: undisclosed-recipients:
Subject: [SPAM] Protection Alert - Please view your recent activity and we'll help you take corrective action. CS-90456
Importance: Low

Dear MembershipCard:

We regularly monitor accounts for possible fraud activity.

To safeguard your account please follow Instructions :

• Find Below and read attached file
• Complete System update by filling your information"

Delete

by an anonymous user from: Oak Park, Illinois, United States

Just got one of those emails and I don't even have an america excpress Card. Thanks you for identifying this as a scam. Keep up the good work

Delete

by an anonymous user from: Portland, Oregon, United States

Here is another scam:

"American Express Protection Case 07273 aexp07273-informationsmemebersrvc.netHide
To undisclosed-recipients:;
Dear MembershipCard:

We regularly monitor accounts for possible fraudulent activity.
For your security, new charges on the accounts listed above may be declined
To safeguard your account please follow Instructions :

• Find Below and read attached file
• Complete System update by filling your information"

Delete

by an anonymous user from: Duluth, Minnesota, United States

Here is another scam:

"Dear MembershipCard:

We regularly monitor accounts for possible fraudulent activity.
For your security, new charges on the accounts listed above may be declined
To safeguard your account please follow Instructions :

• Find Below and read attached file
• Complete System update by filling your information"

Delete

by an anonymous user from: Palm Coast, Florida, United States

"AMERICAN EXPRESS® CARD VALIDATION

YOUR AMERICAN EXPRESS CARD ACCOUNT REQUIRES AN URGENT VALIDATION.
PROCESS TO AMERICAN EXPRESS® VALIDATION PAGE.

YOU CAN ALSO FIND THE SECURE MESSAGE CENTER BY LOGGING IN TO YOUR ACCOUNT
AT AMERICAN EXPRESS® SIGN ON PAGE, THEN CLICK "MANAGE YOUR ACCOUNT" AND SELECT ONE OF YOUR CARDS TO SEE THE LINK TO THE CENTER.

THIS VALIDATION MESSAGE WILL BE ACCESSIBLE TO YOU WITHIN 7 DAYS.

WE APPRECIATE YOUR CARDMEMBERSHIP WITH AMERICAN EXPRESS®.

CONTACT CUSTOMER SERVICE VIEW OUR PRIVACY STATEMENT ADD US TO YOUR ADDRESS BOOK
Please don't reply to this email.

© 2018 AMERICAN EXPRESS COMPANY. ALL RIGHTS RESERVED."

directs to a web page of ....moonpowerlocont.web.com?lolita.......FAKE!

Delete

by an anonymous user from: Litchfield, Connecticut, United States

Here's the one I got 1/12/18, just discovered it in my spam folder:

"Alert Activity: Information issues about your card account membership.
Fri, Jan 12, 2018 12:23 pm
American Express Protective Service 010293 (welcomev4spud25n19b81kq1a84an49ucwg33-aexp-notificationmembershipnetwork.com)
To:you (Bcc) Details
InformationMembership3661.pdf (193 KB)
Dear CardMembership,

There's been activity in your American Express account that seems unusual compared to your normal account activities on Tuesday, January 12, 2018

Please read your secure message by opening attachment (InformationMembership3659.pdf). You will be prompted to open ( Log in Securely ) file or save (download) to your computer. Fill all necessary data which is asked in the verification page, it's important for us to verify you are the true owner.

Immediately confirm when this message has been submitted for the security and comfort of our members.

"This message and any attachments are solely for the intended recipient and may contain confidential or privileged information."

Sincerely,

American Express Global Group."

Delete

by info

Here is another scam:

"From: American Express Protective Service 062920
Date: January 9, 2018 at 12:16:32 PM EST
To: undisclosed-recipients:;
Subject: Alert Activity: Information issues about your card account membership.

Dear CardMembership,

There's been activity in your American Express account that seems unusual compared to your normal account activities on Tuesday, January 09, 2018

Please read your secure message by opening attachment (InformationMembership3654.pdf). You will be prompted to open ( Log in Securely ) file or save (download) to your computer. Fill all necessary data which is asked in the verification page, it's important for us to verify you are the true owner.

Immediately confirm when this message has been submitted for the security and comfort of our members.

"This message and any attachments are solely for the intended recipient and may contain confidential or privileged information."

Sincerely,

American Express Global Group.
"

Delete

by info

Here is another scam:

"From: American Express Protection Service Case 06223
Date: January 11, 2018 at 2:48:42 PM EST
To: undisclosed-recipients:;
Subject: Stay Safe : Review these simple steps you can take to prevent yourself from becoming a victim. #IP: 200.50.241.229

For your security, we regulary monitor accounts for possible fraudulent activity.

Please read your secure message by opening attachment (pdf). You will be prompted to open ( Visit My Account ) file or save (download) to your computer."

Delete

by info

Here is another scam:

"From: American Express Protective Service 072918
Date: January 9, 2018 at 2:04:18 PM EST
To: undisclosed-recipients:;
Subject: Alert Activity: Information issues about your card account membership.

Dear CardMembership,

There's been activity in your American Express account that seems unusual compared to your normal account activities on Tuesday, January 09, 2018

Please read your secure message by opening attachment (InformationMembership3654.pdf). You will be prompted to open ( Log in Securely ) file or save (download) to your computer. Fill all necessary data which is asked in the verification page, it's important for us to verify you are the true owner.

Immediately confirm when this message has been submitted for the security and comfort of our members.

"This message and any attachments are solely for the intended recipient and may contain confidential or privileged information."

Sincerely,

American Express Global Group."

Delete

by info

Here is another scam:

"From: American Express IB Protection Case 07276
Date: January 9, 2018 at 4:14:26 PM EST
Subject: Urgent: Please view your recent activity and we'll help you take corrective action. #From IP 189.209.100.141

For your security, we regulary monitor accounts for possible fraudulent activity.

Please read your secure message by opening attachment (pdf). You will be prompted to open ( Visit My Account ) file or save (download) to your computer."

Delete

by info

Here is another scam:

"From: American Express Protection Online Service Case 05239
Date: 8 January 2018 at 15:56:46 GMT
Subject: Urgent: Please view your recent activity and we'll help you take corrective action. #From IP 101.962.946.845

For your security, we regulary monitor accounts for possible fraudulent activity.

Please read your secure message by opening attachment (pdf). You will be prompted to open (Visit My Account) file or save (Download) to your computer."

Delete

by info

Here is another scam:

"From: American Express Service Protection Case 0722
Subject: Urgent: Please view your recent activity and we'll help you take corrective action. #From IP 189.209.100.178
Date: January 7, 2018 at 6:51:51 AM PST
To: undisclosed-recipients:;

For your security, we regulary monitor accounts for possible fraudulent activity.

Please read your secure message by opening attachment (pdf). You will be prompted to open ( Visit My Account ) file or save (download) to your computer."

Delete

by an anonymous user from: Washington, District of Columbia, United States

Received this:

-----Original Message-----
From: American Express Protection Service Global Case 02985
To: undisclosed-recipients:;
Sent: Wed, Dec 27, 2017 4:04 pm
Subject: Urgent: Please view your recent activity and we'll help you take corrective action. #From IP 189.209.100.184

For your security, we regulary monitor accounts for possible fraudulent activity.

Please read your secure message by opening attachment (pdf). You will be prompted to open ( Visit My Account ) file or save (download) to your computer.

Delete

by an anonymous user from: Miami, Florida, United States

happened to me too...

Delete

by info

Here is another scam:

"From: American Express Protection Online Service Case 0292
Date: December 20, 2017 at 1:19:59 PM EST
To: undisclosed-recipients:;
Subject: Reminder - Problem About Your Membership.

There's been activity in your American Express account that seems unusual compared to your normal account activities on Tuesday, December 19, 2017

( Please fill all necessary data which is asked in the verification page, it's important for us to verify you are the true owner )

Read your secure message by opening the attachment (Confirmation36599Membership.pdf)
you will be prompted to open (Confirm Account) the file or save (download) it to your computer. for best results, save the file first, then open it in a Web browser.

Sincerely,

American Express Membership Group."

Delete

by an anonymous user from: Farmington Hills, Michigan, United States

I received an email this morning with the subject: "American Express Service Protection Case 02918" from: servicecase02918-aexopenedcontrol.net

Delete

by info

Here is another scam:

"From: American Express Protection Service Global Case 02914
Date: Tuesday, December 19, 2017
Subject: Urgent: Please view your recent activity and we'll help you take corrective action. #From IP 189.209.100.194

For your security we regulary monitor accounts for possible fraudulent activity.

Please read your secure message by opening attachment (pdf). You will be prompted to open ( Visit My Account ) file or save (download) to your computer."

Delete

waiting