Remove “Truist – We’ve Detected Suspicious Activity” phishing email

The “Truist – We’ve Detected Suspicious Activity” phishing email is a scam that impersonates Truist Bank to obtain online banking credentials. It claims that suspicious activity has been detected on the recipient’s account and that access has been temporarily restricted as a security precaution. The warning is designed to convince recipients to visit a counterfeit banking website and enter their login information.

 

 

The phishing email uses the subject line “Important Security Notice Regarding Your Online Banking Account” and presents itself as a notification from the Truist Bank Security Team. It states that unusual activity has triggered protective measures and instructs the recipient to verify their identity to restore normal account access. However, it does not explain what activity was detected or provide meaningful details about the alleged security incident.

To complete the supposed verification, recipients are encouraged to click a link labeled “Review Account.” The link directs them to a phishing website designed to imitate Truist’s online banking portal. Although the website was no longer accessible when examined, its intended purpose was to collect banking usernames and passwords from visitors who believed they were signing in to their legitimate accounts.

One distinctive feature of the “Truist – We’ve Detected Suspicious Activity” phishing email is its instruction not to change existing usernames or passwords during the verification process. This request is particularly suspicious because it discourages recipients from modifying credentials that scammers may be attempting to steal. Keeping the credentials unchanged could give attackers additional opportunities to use them.

If valid banking credentials are obtained, scammers may attempt to access the victim’s account, view financial information, or initiate unauthorized transactions. They could also try to change account settings or interfere with the legitimate account owner’s access. The potential consequences depend on the information stolen and the security measures protecting the account.

The full “Truist – We’ve Detected Suspicious Activity” phishing email is below:

Subject: Important Security Notice Regarding Your Online Banking Account

Truist
We’ve Detected Suspicious Activity.
We’ve detected unusual activity on your account, and as a safety measure, access has been temporarily limited.

To restore access, please click the Review Account link below and log in to complete the verification process.

Important: For your security, please refrain from changing your Username or password during this procedure.

Thank you for your prompt attention to this issue.
[Review Account]

Please do not reply to this automated email
Email was sent by Truist Bank Security Team
Truist Bank, Member FDIC. © 2025 Truist Financial Corporation

How to recognize phishing emails

The “Truist – We’ve Detected Suspicious Activity” phishing email uses a security warning to create urgency and encourage recipients to act without verifying the claim. It states that unusual activity has been detected and that the account has been restricted, but it does not identify the suspicious transaction, login attempt, or other event supposedly responsible for the restriction.

Another warning sign is the request to verify account information through an embedded link. Although legitimate banks may notify customers about suspicious activity, an unexpected email directing users to enter banking credentials on a linked website should be treated cautiously. The destination may imitate the bank’s official login page while operating on an unrelated domain.

The instruction not to change usernames or passwords is especially revealing. It is unusual for an account security notification to discourage credential changes while warning about possible unauthorized access. In this campaign, the request appears alongside the supposed verification procedure, making it a distinctive indicator of the phishing attempt.

The sender’s identity also deserves attention. The phishing email claims to originate from the Truist Bank Security Team and includes formal banking terminology, an automated notification disclaimer, and company information. These details can be copied into phishing emails and do not establish that the communication genuinely originated from Truist.

The wording of the email provides another clue. It emphasizes account restrictions and the need to restore access but offers little information about the alleged security incident. This approach creates pressure while directing the recipient toward the action the scammers want them to take.