The "ATT Unusual Sign-in Activity" Phishing Scam
From: ATTCustomerCare@flpd592.prodigy.net (<ATT Customer Care>)
Subject: Your account will be deactivated
Date: April 16, 2018 at 11:05:07 PM CDT
Reply-To: "US AT&T Subscribers" <firstname.lastname@example.org>, <email@example.com>, <ATTCustomerCare@emaildl.att-mail.com>, <firstname.lastname@example.org>
Unusual sign-in activity
This is to inform you that your request on: 16/04/2018 02:37:40.PM. to remove your account @*****.** from ATT Customer Care server has been approved and will initiate in one hour from the exact time you open this message.
If this deactivation was not requested by you
Please reply us.
The link in the phishing email message goes to a fake or phishing SBCGlobal ATT website, which will attempt to trick the potential victims into entering their usernames and passwords on it. If SBCGlobal ATT users attempt to sign into the phishing website with their SBCGlobal ATT usernames and passwords, it will be sent to the cybercriminals behind the email scam, who will use the information to hijack their accounts. The hijacked SBCGlobal ATT accounts will then be used by cybercriminals fraudulently.
Remember, if you receive email messages like these, please go directly to your email account instead of clicking on the links in the email messages. If there is something wrong with your account, it will be shown to you after signing in. And, if you were tricked by one of these phishing scams, please change your password immediately before your SBCGlobal ATT account is hijacked.
For victims whose accounts have already been hijacked, they should contact SBCGlobal ATT for help.