Account Activity Notice Email Scam: The Fake Seven-Day Mailbox Warning

A mailbox notice says a request is pending, but you don’t remember making one. The message offers a button to keep everything working as usual.

It even includes your own domain in the footer. Before treating that familiar detail as reassurance, check what the notice is asking you to trust.

Overview

A supposed mailbox request with a seven-day consequence

The account activity notice email scam claims a request has been made concerning the recipient’s mailbox. It says settings may become inactive within seven days.

A Keep Account Active button is offered as the way to prevent that outcome. The notice leaves the reader to worry about what inactivity would mean.

The message does not establish that a real request exists. Nor does it demonstrate that the email provider has scheduled a change to the account.

A familiar footer leads to an unrelated login

The reported campaign copies the recipient’s domain into its footer. Its button leads to worksy[.]cc, where the page imitates an email-provider sign-in.

The form can change appearance according to the provider being targeted. A Gmail-looking example requests an email address and password.

This is credential phishing. The provider’s design and the personalized footer help the page feel connected to an account relationship they do not authenticate.

Keeping an account active should not require trusting this route

Real providers can send security, account, and inactivity notices. The issue is the specific request and destination, not the existence of account notifications generally.

• A vaguely described request is treated as already pending.
• Seven days sounds like a manageable but pressing deadline.
• The footer repeats information available from the recipient’s email address.
• A preservation-themed button redirects to an unverified authentication page.
• The form seeks the password protecting the actual inbox.

The illustration uses invented addresses and a matching example-domain footer. It demonstrates personalization without claiming to show an authentic notice from your provider.

Your Domain in the Footer Is Not Private Account Knowledge

If someone knows your email address, they already know the text after the @ symbol. Placing it inside a template does not require access to the mailbox.

That simple detail can still be persuasive. A message bearing your company’s domain may feel more relevant than a generic warning signed by an unfamiliar support team.

It can also distract from the actual destination. Readers see a familiar name at the bottom and assume the button belongs to the same organization.

Check those identities separately. A domain written in the message body is not the website collecting a password after a click.

The difference matters especially for custom business mail. Your public email domain may not identify the separate company operating its hosting or identity service.

You do not need to solve that arrangement from the suspicious email. Use the account route your organization supplied or ask the person who manages mail.

Seeing your domain in this footer is no reason to assume the sender has been inside your inbox. They may simply be repeating your address.

How the Account Activity Notice Email Scam Works

Step 1: An unexplained request creates a reason to investigate

The email begins with a claimed account event rather than a demand for payment. Something supposedly happened, and the recipient is invited to react.

If you did not make the request, that may increase curiosity instead of reducing trust. You may click precisely because you want to prevent an unauthorized change.

This reverses the instinct to protect the account. The message presents interaction with an unverified sender as the way to stop someone else’s supposed action.

Pause before accepting that arrangement. An unexplained request should be checked in the real account, not investigated by handing a new page the account password.

Step 2: Seven days makes the warning easy to fit into a routine

A week is less dramatic than an immediate shutdown. That can make the notice sound like an ordinary administrative reminder rather than an obvious emergency.

At the same time, it is short enough to become a task you want cleared. The reader may decide to finish before a weekend or busy workday.

The email concerns allegedly inactive settings. Do not expand that wording into a verified promise that all messages will be erased or a domain will be deleted.

Find out what the genuine account says. The sender’s chosen deadline should not decide where you authenticate or which security instructions you follow.

Step 3: Keep Account Active changes a protective intention into a sign-in

The button names a reassuring outcome rather than the action behind it. Keeping something active sounds safer than approving an unfamiliar account request.

The reported destination is worksy[.]cc. The transition matters because the sender has not established that this site is authorized to manage your mailbox.

Once there, provider-specific presentation can make the page resemble a normal sign-in. Familiar colors and field labels preserve the impression that the original notice was legitimate.

The appropriate alternative is to open the account through a trusted entry point. Any genuine setting requiring attention should be assessed from that context.

Step 4: The real mailbox credential becomes the useful result

The form seeks an email address and password. If the user supplies a usable secret, the operator can attempt access at the actual provider.

The outcome is not automatic. Authentication factors, account controls, and any subsequent approvals affect whether an unauthorized sign-in succeeds.

If the inbox is accessed, messages can reveal contacts and services the owner uses. Those details may support further impersonation or attempts at other account recovery.

However, mailbox access does not automatically defeat every linked service’s protections. Investigate affected accounts according to the information and access actually exposed.

How to Check a Mailbox Request You Don’t Recognize

Open the genuine account without the preservation button

Use the mail app or saved Webmail address you normally trust. Check account notifications and security activity through the service itself.

If it is a workplace account, ask the administrator whether any relevant request exists. A real change may have been initiated by an authorized team.

Do not cancel legitimate settings blindly. First distinguish the fraudulent email from any actual onboarding, access-management, or offboarding work your organization is performing.

This gives you a useful answer either way. You can reject the imitation notice while handling a separately confirmed account matter through the proper process.

Ask what “inactive” actually means for your service

Providers use different rules for account inactivity, storage, subscription status, and access. A generic seven-day email cannot define those policies for every mailbox.

Look up the policy within the genuine service or ask its established support. Avoid instructions copied into the warning as if they were independent documentation.

If you recently changed a subscription or left an organization, there may be a real access question to resolve. Use that known context rather than the email’s shortcut.

For a shared inbox, identify who manages the account before making changes. Several users receiving similar warnings does not make the notice authorized.

Clarify whether the address is a full mailbox, an alias, or a group receiving forwarded mail. The sender may use the same warning for all of them.

An alias may not have its own password or independent inactivity setting. Do not supply another account’s credentials simply because the notice makes that seem necessary.

If you are unsure which arrangement applies, ask the administrator. They can identify the service without asking you to test a credential on the linked page.

Keep that account map for future genuine support questions. Knowing who manages an address makes a vague administrative warning much easier to assess next time.

Use sender details as evidence, not a final verdict

Expand the actual From and Reply-To information if available. Save the original message for someone who can examine its technical details.

A familiar display name or footer can be copied. Even successful message authentication for an unrelated sending domain does not turn that sender into your provider.

There is no need to reply asking whether the request is genuine. That lets the sender provide another unsupported reassurance.

Google’s phishing guidance recommends going directly to the relevant service rather than entering a password after an untrusted message link.

If the Email Arrived at a Mailbox You Rarely Use

An inactivity warning can feel especially plausible when the address is old or seldom checked. The sender may benefit from that coincidence without knowing your habits.

First decide whether you still need the real account. If so, sign in through its legitimate route and review its actual status and recovery details.

If you want to close it, use the provider’s official closure process. Do not use a stranger’s link to preserve or delete an identity.

Before closing any genuine account, consider services that still depend on its email address. Change important recovery contacts through those services themselves.

For an old work address, ask the former employer’s appropriate contact about access. Do not attempt to bypass organizational restrictions because the notice suggests an urgent workaround.

These decisions concern the account you own or are authorized to use. They are separate from the false request introduced by this phishing email.

A Page Error Does Not Resolve a Password Disclosure

A current capture of the reported root returned a server error instead of the imitation login. That does not reveal what an earlier form collected.

If you entered credentials when the page worked, respond to that exposure. Do not conclude the incident is over because the website later stopped responding.

Conversely, receiving the email or seeing an error does not prove account takeover. Identify whether you typed credentials, accepted a prompt, or installed something.

The available campaign details establish the account-preservation pretext and password target. They do not establish a malware family or a completed intrusion into every recipient’s account.

What to Do If You Fell Victim

1. Stop using the account-preservation link. Leave the form and ignore follow-up requests to complete, reverse, or validate the supposed mailbox request.

   If nothing was supplied, report the notice and check the genuine account separately. Do not expose a password just to find out whether the warning is true.

2. Replace an exposed password at the actual provider. Use a familiar app or independently opened account page. Protect other services sharing the same secret.

   For a managed mailbox, tell the administrator promptly. For personal Google accounts, use Google’s compromised-account guidance if sign-in or recovery details have changed.

3. Have continuing account access checked. Review unfamiliar sessions and devices, recovery settings, forwarding, rules, and connected access where your provider supports those controls.

   Tell support about any code or approval provided after the password. A complete description is more useful than assuming the password change ended every session.

4. Assess the messages an intruder could have used. Check unfamiliar sent items and important recent conversations. Warn affected contacts through a separate trusted route when necessary.

   If the mailbox handles payments, have relevant staff independently confirm changed instructions. A forged message can remain dangerous after the intruder loses access.

5. Confirm the account’s real administrative status. Ask about actual pending requests, subscriptions, or access changes. Resolve genuine requirements through the responsible provider or organization.

   Do not remove approved workplace settings merely because the phishing notice mentioned them. Let the administrator separate authorized work from suspicious changes.

6. Check software exposure only when applicable. Malwarebytes can help investigate suspicious files, extensions, or unwanted programs used during the interaction.

   AdGuard may limit malicious advertising and known unsafe destinations. Neither tool keeps an online mailbox active, revokes an unauthorized session, or replaces recovery at the provider.

7. Report the original notice and keep a useful record. Use the provider’s phishing feature or your organization’s established reporting channel, preserving the original when requested.

   Do not circulate the live button while warning others. Explain the seven-day preservation story and remind them to check accounts independently.

Is Your Device Infected? Run a Free Malware Scan

Slow performance, constant pop-ups, or strange behavior? These are classic signs of a malware infection. The fastest way to find out is to scan your device with Malwarebytes Free — one of the most trusted malware removal tools available.

The free version detects and removes the most common threats, including:

• Adware — the cause of those annoying pop-ups
• Browser hijackers — unwanted redirects and changed homepages
• Trojans and spyware — hidden programs stealing your data
• Potentially unwanted programs (PUPs) — software you never asked for

👉 Select your device below — Windows, Mac, or Android — then follow the simple steps to download Malwarebytes, scan your system, and remove any threats it finds. The scan usually takes 5 to 20 minutes.

Stay Protected: Block Ads and Malicious Sites

Now that your device is clean, keep it that way. Most infections start with a malicious ad or a fake download button — so blocking them at the source is your best defense.

We recommend AdGuard, which blocks malicious ads, phishing pages, and dangerous redirects before they can reach you.

👉 Download AdGuard and browse safely

Frequently Asked Questions

Is a real request pending on my mailbox?

The notice does not establish one. Check the actual account or ask its administrator before accepting the email’s description of an account change.

Why does the footer include my domain?

That information can be taken from the recipient’s email address. Repeating it in a template does not require mailbox access or prove the sender’s authority.

Will the account stop working after seven days?

The deadline is part of the lure. Real account policies vary, so verify any actual requirement through the genuine provider rather than this preservation button.

Does a Gmail-looking form mean Google is involved?

No. A page can imitate provider branding without being operated or authorized by that provider. Check the authentication route, not just the design.

What if I never use that address anymore?

Make any decision about maintaining or closing the real account through its official service. An unused address does not make the unsolicited link safe.

Can I ignore recovery because the phishing page now fails?

No, not after credential exposure. A later error says nothing dependable about information entered earlier. Secure the real account and review its access.

The Bottom Line

Do not use this Account Activity Notice to keep your mailbox active. Its seven-day claim and personalized footer lead toward an unverified password request.

Check any real account issue through your provider. If you supplied credentials, recover the genuine mailbox and inspect continuing access before considering the matter resolved.