Identify fake AT&T emails

You can protect yourself from email scams by learning how to recognize them. If you suspect an email is fake or wasn’t sent from AT&T, don’t open it, click any links, or open any attachments. These links or attachments can download malicious software or viruses to your phone, tablet, or computer.

Any of these signs can indicate a fraudulent email that needs to be reported and deleted:

• Makes unusual claims about your bill – Unusual alerts that a bill is ready, your account needs to be verified, or that a payment needs to be confirmed.
• Requests personal information or account information.
• Claims a high total balance is due.
• Doesn’t include account number - Legitimate AT&T bill notices typically list your account number or several digits of the account number.
• Links to non-AT&T websites - Hover over the links in the email to see the true destination. The pattern of a malicious site is typically: https://[non-att.com domain]/[random text]/[random text.html]. The links lead to a malware payload website, which changes frequently to circumvent blocking. The links have no affiliation with AT&T and they are compromised websites.
• Includes attachments - Legitimate AT&T bills typically do not include attachments. Fraudulent attachments are in .zip format and many have names beginning with ATT_Payment.

If you suspect and email is malicious, take steps immediately to resolve the problem:

1. Review the email carefully. Do not click any links or download any attachments. 
2. Report the email:
   • On currently.com: Select the Spam button in the toolbar above the message. This also deletes the email from your inbox.
   • In an email program: Forward email to AT&T at abuse@att.net. When possible, include the full email header to help us identify the origins of the email.
3. Delete the email, if it hasn’t already been removed.

We have identified common examples of fraudulent emails. Review these examples and report and remove any messages with similarities.

Webmail upgrade
The message says your email inbox messages are pending or have been put on hold due to a recent webmail upgrade.



Account verification
The subject line refers to account shutdown, and the email asks you to verify your account.


Account Sign-in
The subject line refers to a new or past-due account balance, and the email asks you to sign in to your account.



Payment details
The email appears as a payment confirmation, and then asks you to open an attachment to review payment details.



Note: Remember, it may be something other than email. It can also be text messages, phone calls, and more. Hackers are always thinking of new ways to scam unsuspecting customers, and those scams don't always come in the form of email. Don't provide any information if you're not sure that the website you're visiting is owned by AT&T.