A Sample of the Phishing EarthLink Email Message
Subject: Security Alert: Your Account Has Been Disabled
Date: Tue, 02 Jan 2018 15:52:51 +0100
From: EarthLink Support <Support@earthlink.net>
YOUR ACCOUNT HAS BEEN SUSPENDED DUE TO INVALID CREDIT CARD.
We Have Been Unable To Charge Your Credit Card Due To Declined Or Replaced Credit Card
You Will Be Disconnected Within 24hrs Of Receiving This Message If You Do Not Verify Or Place A New Credit Card On File .
Your Card Has Been Reported Stolen By Your Bank Or It Might Have Been Replaced By Your Issuing Bank .
We Strongly Recommend You To Click The Link Below , You Will Be Redirected To Your Billing Area To Verify Or Place A New Credit Card On File
Invoice Amount: 7.95
Payment Due Date: AUTOPAY
DELETE THIS MESSAGE IF YOU WISH TO LOCK YOUR ACCOUNT PERMANENTLY
To Verify Or Place A New Card On File, CLICK HERE TO VISIT MYACCOUNT.
Manage your EarthLink account on the go with the myEarthLink App!
Download from the Google Play store or iTunes store now!
By using the Services, you agree to EarthLink's terms at www.earthlink.net/about/policies/
© 2017 EarthLink, LLC. EarthLink and the EarthLink logo are registered trademarks of EarthLink, LLC. Trademarks are property of their respective owners. All rights reserved.
This is an administrative message from EarthLink. It is not spam. From time to time, EarthLink will send you such messages in order to communicate important information about your subscription. If you believe you received this message in error, please contact EarthLink Support (links provided above).
EarthLink, 1439 Peachtree St. NE, Atlanta, GA 30309.
The link in the fake email message goes to a fake EarthLink website, which was created by cyber-criminals to trick their potential victims into entering their EarthLink usernames, passwords and credit card information on it. If the requested information is submitted by the potential victims, it will be sent to the cyber-criminals, who will use it to steal their money and use their accounts fraudulently. The cyber-criminals/scammers behind the phishing email message will change the website's name, so look out for similar phishing email messages with links that go to different phishing websites.
If you are tricked into submitting your EarthLink credentials and credit card information on the fake web page, please change your EarthLink password immediately and contact your bank and let them know that you have submitted your credit card information on a phishing website.
Remember, never click on a link to sign into your EarthLink account, always go directly to www.earthlink.net and log in from there instead.