Remove “Capital One – Secured Message” email

The “Capital One – Secured Message” email is a phishing attempt that tries to trick users into revealing their Capital One login credentials. The email is disguised as a security notification from Capital One’s Card Fraud Department and informs recipients that their accounts have been temporarily suspended because of suspicious account activity. The email claims that recipients need to review the transactions by clicking on the provided button, and this will supposedly reactivate their account. If recipients engage with the email and click on the button, they will be taken to a Capital One phishing site. If recipients try to log in with their credentials on the fake Capital One site, they will be immediately transferred to the cybercriminals.

 

 

This phishing email, disguised as a security alert from Capital One informs you about supposed suspicious activity on your account with an urgent message from the Fraud Department. Supposedly, your account has been suspended until you review suspicious transactions made from your account. The email has a “Review and update” button, which if clicked, will redirect users to a phishing site. The site may look very similar to Capital One’s login page. If you type in your credentials, they will be immediately transferred to the cybercriminals operating this phishing scam, which could allow them to access the account.

Login credentials, especially for financial accounts, are prime targets for cybercriminals. Users must learn how to identify phishing emails to protect themselves from potential account hijacking and financial theft. If you believe you’ve been a victim of this phishing scam, reach out to Capital One immediately to secure your account.

The full “Capital One – Secured Message” email contents are below:

Subject: You Have a Secured Message from Capital One Card Fraud Department

Capital One | Venture

You Have a Secured Message from Capital One Card Fraud Department, We need updated information

Dear -,

For your protection, we have temporarily suspended activity on your account until we can verify the authenticity of these transactions. We apologize for any inconvenience this may cause and appreciate your prompt attention to this matter.
Review and update

Updating your info online is secure, quick and easy.

You can also call 800-227-4825—or sign in to your account and review your info under Account Settings.

Thanks for being a Capital One customer.

Capital One will never ask you to validate information such as your user ID, password or account numbers. If you receive a request like this, please let us know right away by calling the number on the back of your card.

What are the signs of a phishing email?

There are many varying degrees of sophistication to phishing campaigns. The ones that target many users at the same time tend to be quite generic and not difficult to identify because they have all the signs pointing to them being malicious. If users are familiar with what those signs are, they should have no trouble noticing them. Sophisticated phishing campaigns usually only target high-profile targets. Such email campaigns are significantly harder to identify because they look very professional and legitimate. Fortunately, most users will generally encounter generic phishing emails.

The sender’s email address is the biggest giveaway when it comes to phishing emails. Thus, that’s the first thing you should check if you receive an email that asks you to do something (e.g. open an attachment or click on a link. A quick Google search can help determine whether the email address matches the sender’s identity. Generic phishing emails are usually sent from random addresses, while more sophisticated attacks may use addresses that closely resemble those of legitimate organizations. For example, the “Capital One – Secured Message” email comes from a clearly fake address because it does not use Capital One’s official domain, making it easy to identify as a phishing attempt immediately.

Another warning sign to watch for in emails is poor grammar and spelling. Many phishing emails are riddled with mistakes that would be unlikely in legitimate emails. In the case of the “Capital One – Secured Message”, it does not have obvious mistakes but it still reads very unprofessionally. The usage of the email’s handle when greeting the recipient is another giveaway. Emails from Capital One to customers will always address users with their names.

We should caution you that you should always take a moment to examine any email that asks you to do something, such as clicking a link or opening an attachment. For links, hover over them to see where they lead before clicking. For attachments, use an anti-virus program or services like VirusTotal to scan the files before opening them. If an email suggests there is an issue with your account, the safest course of action is to log in directly to your account to verify the supposed issues instead of clicking any links provided in the email.