The "EarthLink Your Account Has Been Locked" Phishing Scam
From: Earthlink Support <firstname.lastname@example.org>
Sent: Monday, May 21, 2018 3:49 AM
Subject: Earthlink Billing Support : Account Suspended ,You Have Been Disconected
Your Account Has Been Locked,Credit Card Declined
Dear EarthLink Subscriber,
According to our records, your EarthLink® account #XXXXX is set to be paid by a recurring automated charge to your CREDIT CARD. Unfortunately, your credit card company has declined our most recent request for payment, resulting in a past due balance of $36.62.
To avoid disconnection, please update your billing information and pay your outstanding balance with a different credit card. This will help avoid service interruption. EarthLink offers several convenient ways for you to make this change:
CLICK THE LINK BELOW TO CONFIRM YOUR CARD OR PAY WITH BANK ACCOUNT
Online via My Account:
CLICK HERE, TO PAY WITH CARD OR BANK ACCOUNT
Provide your credit card information and then click "Save Changes"
The link in the fake email message goes to a fake EarthLink website, which was created by cyber-criminals to trick their potential victims into entering their EarthLink usernames, passwords and credit card information on it. If the requested information is submitted by the potential victims, it will be sent to the cyber-criminals, who will use it to steal their personal information and use their accounts fraudulently. The cyber-criminals/scammers behind the phishing email message will change the website's name, so look out for similar phishing email messages with links that go to different phishing websites.
If you are tricked into submitting your EarthLink credentials and credit card information on the fake web page, please change your EarthLink password immediately and contact your bank and let them know that you have submitted your credit card information on a phishing website.
Remember, never click on a link to sign into your EarthLink account, always go directly to www.earthlink.net and log in from there instead.