> ## Content Index > Fetch the complete content index at: https://logbook.watchstander.tech/llms.txt > Use this file to discover other available public pages before exploring further. # The Email That Wants You to Sign In - URL: https://logbook.watchstander.tech/the-email-that-wants-you-to-sign-in/ - Published: 2026-10-03T22:27:17.000Z - Updated: 2026-10-10T15:13:48.000Z - Author: Andrew Berry - Tags: Scam Alert Most of you have gotten some version of this email. The subject line says "Action required: your account is on hold." The logo looks right. The message says there was a problem with your last payment, and if you don't update your billing details within 24 hours, your service will be suspended. Below that sits one big button: **Update payment**. That's phishing, and it's the crime people most often report to the FBI. In its 2025 report, the FBI's Internet Crime Complaint Center logged 191,561 phishing and spoofing complaints, more than any other category. People over 60 filed 48,064 of them, more than any other crime type for that age group. Once you see how these emails work, the fix turns out to be one simple habit. ## The story is always one of a few. The Federal Trade Commission lists the stories phishing emails tell, and they're remarkably consistent. Someone noticed suspicious activity or login attempts on your account. There's a problem with your account or your payment information. You need to confirm some personal or financial information. Notice what those have in common: they hand you a problem and a deadline at the same time. The worry is the point. A worried person clicks first and thinks second. The sender is dressed up to match. The name at the top might say Amazon, Netflix, PayPal, Microsoft, or your bank. That display name is just text, and anyone can type anything into it. Making a message appear to come from someone else is called spoofing. ## The button opens a fake sign-in page. Here's the part most people never see. That button leads to a sign-in page that looks exactly like the real one: the same colors, the same logo, the same "Forgot password?" link. Copying the look of a web page is easy. You type your email and password, and maybe the page asks for your card number "to confirm it's you." Then it might show an error, or quietly pass you along to the real site, so nothing feels off. Meanwhile, your password and card number went straight to whoever built the page. If you use that same password anywhere else, they'll try it there too. Some phishing emails include an attachment, such as an "invoice" or a "secure document." If you weren't expecting it, don't open it. Scammers also send text-message versions, and many disguise the web address itself with look-alike letters. I covered that trick in [my post on homoglyph attacks](https://logbook.watchstander.tech/homoglyph-attacks-the-url-that-isnt/). ## Why "look closely" isn't enough anymore. For years, the advice was to watch for bad spelling and clumsy grammar. CISA, the federal government's cybersecurity agency, now points out that in the era of AI, some phishing emails have perfect grammar and spelling. The logos are perfect, too. So don't try to win at spot-the-fake. Change where you go instead. ## The one habit: don't sign in from a message If an email says something's wrong with an account, don't use its link or button. Close it. Then go to the company the way you normally would: open the app you already have, type the address yourself, or use a bookmark you saved. If there really is a problem, it'll be waiting for you there. The FTC offers a good gut check: Do you even have an account with that company? If not, it's phishing. If you do, contact them using contact information you already know is real, never anything in the message. Two tools back that habit up: - **A password manager.** It offers to fill in your password only on the website where it was saved. On a look-alike page, it stays quiet, and that silence is your warning. ([Here's why I set nearly everyone up with one.](https://logbook.watchstander.tech/why-i-set-nearly-everyone-up-with-a-password-manager/)) - **Multifactor authentication (MFA).** That's a second check after your password, like a code sent to your phone, so a stolen password alone won't get anyone in. One caution: if someone asks you to read that code back to them, they're the scammer. ## For small businesses You also receive these in your inbox, often as a "your password expires today" notice or a shared document waiting for you to sign. Make one rule for the whole team: nobody signs in from a link in an email. Then show everyone where the "Report phishing" or "Report spam" button lives in your email program, so one person's catch protects the whole office. ## If you already clicked Don't panic, and don't feel foolish; these are built to fool smart people. Just move quickly: 1. Go to the real site (not through the email) and change that password. Change it anywhere else you used it, too. 2. Turn on MFA for that account if it isn't on already. 3. If you typed in a card number, call the number on the back of your card and report it. Federal law gives you protections against unauthorized charges. 4. If you gave out your Social Security number, go to IdentityTheft.gov for a step-by-step recovery plan. Then report the email. Forward it to [reportphishing@apwg.org](mailto:reportphishing@apwg.org), and report the scam at ReportFraud.ftc.gov. These emails aren't going to stop. You don't have to catch every fake; you just need one habit: a real problem will be waiting for you in the app. Stay sharp out there. Andrew