Remove “Action required: you have 5 incoming messages pending review” phishing email

The “Action required: you have 5 incoming messages pending review” scam is a phishing email that claims several incoming emails are being held for security checks. The message tells the recipient that five emails are pending review and will not be delivered until action is taken. It presents this as a protective measure by the email service. This claim is false and is not issued by a legitimate provider.

 

 

The email urges the recipient to review or release the pending messages through a provided link. The wording focuses on verifying the account to prevent message loss. The link does not lead to a real email dashboard. Instead, it opens a fraudulent web page that imitates a webmail login portal.

The fake page displays fields for an email address and a password. It may also show a short notice about blocked or quarantined emails to reinforce the claim. The layout can resemble a common webmail interface, but the domain in the browser’s address bar does not belong to the actual email provider. The page exists only to collect login credentials.

When the recipient enters account details, the information is transmitted to the scammers. The page does not release any messages and does not connect to the real mailbox. After submission, it can display a generic confirmation message or redirect to a legitimate login page to avoid raising suspicion. By then, the credentials have already been captured.

The targeted information in the “Action required: you have 5 incoming messages pending review” scam is the email account login. With access to the mailbox, attackers can read private emails, download attachments, and view contact lists. Email accounts are also used to reset passwords for many other services. Once the inbox is compromised, scammers can request password changes for linked accounts and approve them through the stolen email account.

Control of the mailbox also allows scammers to send emails while impersonating the owner. They can distribute phishing emails to contacts using the same pending message theme or other false claims. Since these emails come from a real address, recipients are more likely to trust them and follow the links. This extends the impact beyond the initial victim.

The claim about five pending messages is a tactic designed to create urgency and curiosity. The scammers do not have control over the recipient’s email system and cannot block or release messages. The warning is intended to push the recipient to sign in on the fake page without verifying the sender.

The full “Action required: you have 5 incoming messages pending review” phishing email is below:

Subject: Past Due Notification: Action Required to Avoid Service Interruption

Dear -,

Action required: You have 5 incoming messages pending review.

For security reasons, your mailbox has temporarily held these messages. Please review and authorize delivery to your inbox.
Review Messages

This process helps ensure important communications reach you while maintaining mailbox security.

Sincerely,

– Administration

This notification was sent to –
You can manage notification preferences from your account settings.

How to identify phishing emails

The “Action required: you have 5 incoming messages pending review” scam arrives as a standard email that appears to be a security alert. The subject line contains the same wording as the keyword or a close variation referring to pending or held messages. The sender name is written to look like a mail administrator or support team. A closer look at the full sender address shows a domain unrelated to the legitimate email provider. This mismatch is a key indicator of fraud.

The body of the email is brief and focused on the pending message claim. It may list the number of held emails and include a short summary to make the notice appear authentic. The message urges immediate action through the provided link. It does not include verified account details, message previews from real senders, or references that legitimate providers normally include.

The phishing page linked in the email mimics a webmail login screen. The domain in the browser’s address bar does not match the official service domain and can contain random words or slight spelling changes. The page emphasizes credential entry rather than displaying actual mailbox content.

Another defining trait is the narrow focus on reviewing or releasing messages. The same theme appears in the subject line, body text, and action button. The email does not mention billing, storage limits, or account upgrades. It stays centered on the pending message warning.

Legitimate email providers manage spam and security filtering within official account dashboards. They do not require users to enter credentials through external links in unsolicited emails to review messages. The combination of a pending message warning, a mismatched sender domain, and a login page hosted on an unrelated site defines the “Action required: you have 5 incoming messages pending review” scam.