“Your mailbox is full” and “verify your email account” scams: how to spot them and what to do if you entered your password

What the scam looks like

The message poses as a notice from your email provider, your workplace or school IT team, or “Microsoft”. The wording changes but the trick doesn't: there's a problem with your mailbox and the only fix is to sign in through a link. Versions documented by official sources:

• Mailbox full. You've run out of storage and won't receive new emails or attachments until you sign in to “increase your quota”.
• Verify or upgrade your webmail. The system is overloaded and your account must be verified, or you'll lose access for good. The link leads to a copy of a webmail sign-in page (a wave reported in May 2026 by the security team at Masaryk University in the Czech Republic).
• A fake work sign-in page. The page looks exactly like the sign-in for Office 365, Teams or another service (a campaign flagged by the Slovak national CERT).

The email often comes from a real address – a hacked account belonging to a colleague, a school or a public body. Each stolen account is then used to send more phishing, so the scam spreads from one victim to their contacts.

Why it's about more than your email

Your email password is the key to your other accounts. The UK's National Cyber Security Centre (NCSC) puts it plainly: if criminals get into your email, they could reset all your other account passwords and get access to all your other online accounts. If you use the same password elsewhere, they'll try it there too.

A work mailbox carries an extra risk: someone reading it knows your open orders and can email your customers a "new bank account" for an invoice – from your real address, so it looks genuine. How to spot it and what to put in place at work: Supplier says their bank details changed.

How to spot the fake

Any one of these is enough:

• It wants you to sign in through a link. That's the whole point of the message. Genuine providers show storage and security warnings inside your mailbox, where you can see them after signing in the normal way. SK-CERT reminds users that Microsoft and other large companies don't email users asking for personal information.
• Urgency and threats. “Within 24 hours”, “you will permanently lose access”, “incoming messages are on hold”. The pressure is there to stop you thinking it through.
• The page address doesn't belong to your provider. The domain only looks similar, has an extra word or a different ending. Check the address bar before you type a password.
• The sender's address proves nothing. The message may come from a spoofed address or from a real account that's been hacked. Familiar logos and layouts prove nothing either. The FTC lists “a problem with your account” and “suspicious activity” among the most common phishing pretexts.

How to check your mailbox safely

1. Don't click the link and don't reply to the message.
2. Open your email yourself – the app on your phone or a webmail address saved in your bookmarks.
3. Look at storage and alerts in your settings. If there's a real problem, you'll see it there.
4. Work or school account? Ask your IT team or helpdesk by phone or in person, not by replying to the suspicious email. Forward it to them so they can warn others.

Already entered your password?

Work through these steps in order:

1. Check forwarding and filters first. The NCSC warns that criminals often set up a forwarding rule so they automatically get a copy of all your emails – including password reset links. Look in your mail settings (Forwarding, Filters, Rules) and delete anything you didn't set up.
2. Check your recovery details. Make sure the recovery phone number and backup email are still yours; scammers change them so they can reset your password again later.
3. Set a new password. Strong and used only for your email, as the NCSC recommends.
4. Sign out all devices. The NCSC advises making sure any devices and apps that may still be logged in are signed out of the account. The option is usually in your account or security settings.
5. Turn on 2-step verification. The NCSC recommends adding it to your email so a password alone isn't enough to get in. See Two-step verification: how to turn it on.
6. Change any password that was the same, and check important accounts (bank, social media, online shops) for password reset or sign-in emails you didn't request. A password manager makes unique passwords easy.
7. Warn your contacts. The NCSC suggests telling people you were hacked and asking them to treat recent messages from your account with suspicion. For a work or school account, tell your IT team straight away.

If you're locked out or the scammer has taken over other accounts too, continue with Hacked account: what to do. If you also entered other details on the fake page, such as card or online banking details, follow Entered your details on a phishing site.

Where to report it

• Your email provider: mark the message as phishing or junk in your mailbox.
• Work or school account: your IT or security team.
• UK: forward the email to the NCSC's Suspicious Email Reporting Service at report@phishing.gov.uk.
• US: forward phishing emails to reportphishing@apwg.org and report to the FTC at ReportFraud.ftc.gov.
• Account misused or money lost: contact your bank and report it to the police.

The same trick drives fake parcel delivery texts, Netflix “account on hold” messages and tax refund scams – always a link, always a sign-in or a card.