"American Express Unable to Process Membership" Scam

The "American Express Update Your Income Information" email message below which appears to be an alert from American Express claiming a request to update the recipient's email address and other records is just one of the many phishing scams created by cybercriminals to trick American Express customers into clicking on the link within it. The link goes to a phishing website (a fake American Express website) that steals online account credentials when visitors attempt to sign into it.

American Express cardholders are asked never to click on a link in an email message to access to their accounts. They should instead, go directly to American Express website (www.americanexpress.com) and sign into their accounts from there. If there is something wrong or there is something that they need to with their accounts or cards, they will be notified after signing in.

The "American Express Unable to Process Membership" Scam

From: American Express Update Services <alert-confirmation.id151@live-globa365mex.com>
Sent: Friday, February 16, 2018 11:41 AM
Subject: REMINDER: Unable to process membership
Attachment: LoginMembership365.pdf
Customer Care Reminder
Dear Cardmember Account ending: 3***
We are writing to you because we need to speak with you regarding a security concern on your account. Our records indicate that you recently used your account American Express on Friday, February 16, 2018 from IP 3.8.158.24
For your security, new charges on the accounts listed above may be declined. if applicable, you should advise any Additional Card Member on your account that their new charges may also be declined. To safeguard your account, please access your account Acces my account
Sincerely,
American Express Care Team
Dtear Ca0rdmem5be9r,
Wey re9cently rec7eived yourn rhequexsut tso uxpdnate3 youir4 e2mail0 adzdresnsg and h0ave updatgede o9upr reccor5dsw acncomrdti4njgly.
Pljease read7 yourh soecur4e moe4ssaqge biye openin5g att4achcmmentn (LoginMembership365.pd5f9).4 Yo8ux willm bek promvp6tedn tso open ( Acpces may account ) filze or0 save (doo0wn1louadt) to yovura cuom5pzuvter.
Imvmediaately coln2firim whens this4 meswsahge ha8s beenk submwitted f0or tmhe secuyr1ity and comfjodr9tj owf2 ouir meembzehrls.w
Your Sinrcsere2l4y,l