Remove “Email Account Is Marked Dormant” phishing email

The “Email Account Is Marked Dormant” phishing email is a credential-stealing scam built around a fabricated account status. It tells recipients that their email account has become dormant and must be verified to remain active.

 

 

The email uses the subject “Email Verification” and presents itself as an automated account maintenance notice. According to the warning, the recipient’s email address has already been classified as dormant. The email then claims that both the address and its password must be verified immediately to prevent the account from being shut down.

A “VERIFY EMAIL” button is provided to supposedly complete this process. The email also states that the service is free of charge, helping frame the requested action as a routine administrative procedure rather than something potentially suspicious.

There is no genuine account verification behind the button. Selecting it opens a fraudulent website containing a generic “Webmail Login” form. The site asks visitors to provide an email address and password.

In many cases, the email field is already populated with the recipient’s address. This personalization can make the page look as though it has retrieved information from the user’s actual mailbox. In reality, the address is passed to the phishing page through the link.

The password entered on this page is captured by the scammers. Supplying it does not reactivate a dormant mailbox, verify the account, or prevent an account shutdown.

The scam does not represent a legitimate email service provider. Its broad references to an email account and generic Webmail login allow the same campaign to target users without having to convincingly impersonate one specific provider.

Compromised email credentials can expose information stored in the victim’s inbox and potentially give attackers access to password-reset emails for other services. Scammers may also attempt to change account settings or lock the legitimate owner out of the mailbox.

Anyone who has submitted a password through the fake Webmail page should change it through the actual email provider immediately. The same password should also be replaced on other accounts where it has been reused.

The full “Email Account Is Marked Dormant” phishing email is below:

Subject: Email Verification

Attention :
Your email account – is currently marked dormant.
To avoid account shut down Please verify your email and password to complete verification now.
[VERIFY EMAIL]

This service is free of charge
– © 2026 All rights reserved

How to recognize the “Email Account Is Marked Dormant” phishing email

The dormant-account claim is the central pressure tactic in this campaign. Recipients are not given a detailed explanation of why their mailbox was supposedly classified as dormant. Instead, they are quickly warned that verification is necessary to avoid shutdown.

This lack of provider-specific information is significant. A genuine account maintenance notice would normally be associated with the service that manages the mailbox. The “Email Account Is Marked Dormant” phishing email relies on generic terminology that can apply to almost any email user.

Its request to verify both the email address and password should also raise suspicion. The recipient is directed toward an embedded “VERIFY EMAIL” button rather than instructed to access normal account settings through their existing webmail service.

Following that button reveals another inconsistency. Instead of opening a recognizable account-management portal, the link leads to a generic Webmail login page on an unrelated website. The form’s ability to display the correct email address does not make the page legitimate.

Recipients should pay particular attention to the domain displayed in the browser. A phishing site can reproduce familiar login elements and automatically insert information taken from a link, but it cannot legitimately become part of an email provider simply by displaying the user’s address.

The shutdown threat can also be checked without interacting with the email. Users can open their normal webmail application or manually access their provider’s official site. If an account genuinely requires verification or has been restricted, relevant information should be available through the legitimate service.

The wording “This service is free of charge” is another unusual detail in context. The email is supposedly warning about a dormant mailbox, yet it specifically reassures recipients that the verification process costs nothing. This does not establish that the notification is legitimate.