Remove “Capital One – Email Address Change” email scam

The “Capital One – Email Address Change” email is part of a phishing campaign that intends to gain access to users’ Capital One accounts. The email claims that the email address associated with your Capital One account has been changed, supposedly per your request. The email informs you that if you did not initiate the change, you need to secure your account immediately. The email provides a button for you to supposedly recover your account. If you click the button, you will be taken to a Capital One phishing website that asks you to log in. Typed-in login credentials will be stolen.

 

 

If you get “Capital One – Email Address Change” email in your inbox, pay no attention to its contents as it’s a phishing attempt. The email is disguised to look like a security notification from Capital One to inform an account holder about changes made to the account. Supposedly, the email address connected to the account has been changed, and if users did not initiate the change, they are asked to click on the provided button to recover their accounts. The email also mentions that in order to recover it, users will have to verify it as well via SMS.

If you click on the “Recover Your Account Now” button, you will be taken to a phishing website that intends to steal login credentials. The website may look like an identical copy of Capital One’s legitimate login page. If users type in their credentials, they would be immediately sent to the cybercriminals operating this phishing campaign. This highly sensitive information stolen by cybercriminals could lead to banking accounts being hijacked. Thus, falling for this phishing campaign could lead to financial loss.

The full “Capital One – Email Address Change” email scam text is below:

Subject: Your Email Address Has Been Successfully Updated to r******************e@outlook.com.

Capital One

Your Information Has Been Updated.

Learn more about Eno, your Capital One assistant

Dear Card Member,

As requested, we’ve changed your email address from ******** to r******************e@outlook.com.

Your security is important to us. If this change was unauthorized or incorrect, please use the link below to recover your account immediately. (You wil need to verify your Account ownership via 2x to 3x email or sms OTP Verifcation to recover your account.)

Recover Your Account Now

Thank you for your Card Membership

How to recognize a phishing email

Unless users are targeted specifically, they should be able to identify phishing emails as they are usually very generic. They have many mistakes, are sent from random-looking email addresses, and generally look very unprofessional. Sophisticated phishing campaigns are usually reserved for targeted individuals and high-profile people/companies. Sophisticated phishing emails look legitimate, contain information that gives the email credibility, include the target’s personal information, and more. Fortunately, regular users usually deal with generic phishing emails that are not difficult to identify.

When you receive an unsolicited email asking you to click on a link or open an attachment, verify the sender’s email address before you do anything. A simple Google search can help determine whether the address is legitimate. Generic phishing emails are often sent from random-looking addresses, while more sophisticated attempts might use email addresses that closely resemble those of legitimate companies or organizations. In this particular case, the “Capital One – Email Address Change” phishing email was sent from an obviously fake email address as it does not look professional.

Another thing that may help identify malicious emails is grammar/spelling mistakes. If you notice a mistake in an email from a company like Capital One, it’s almost certainly a malicious email and the sender isn’t actually Capital One. You should also take note of how an email addresses you as it can tell you a lot about its legitimacy. If you are a Capital One customer, their emails will address you by name. The “Capital One – Email Address Change” email addresses recipients as “Card Member”, which is an immediate giveaway.

We recommend taking the time to carefully examine emails that urge you to click on links or open attachments. If the email contains a link, hover over it to reveal where it will take you before clicking. For attachments, use an anti-virus program or a service like VirusTotal to scan them before opening them. If the email mentions an issue with your account, refrain from clicking links and instead, log into your account manually to check for any problems. Lastly, always check the URL of a website before logging in. Phishing sites may closely resemble legitimate ones in appearance, but their URLs will always be different.

Remove “Capital One – Email Address Change” email scam

Delete “Capital One – Email Address Change” email scam from your inbox if you get it. Pay no attention to the contents as the email is entirely fake. If you have interacted with the email and typed in your login credentials, you need to contact Capital One and inform them that you have been a phishing attack victim and that your account may be compromised.