“Your account is locked” and other account warnings

The stories

The FTC's guide to recognizing phishing lists the stories these messages tell. They say there's been suspicious activity or sign-in attempts on your account. They say there's a problem with your account or your payment information. They ask you to confirm personal or financial details. They include an invoice you don't recognize, or a link to make a payment, or say you're eligible for a government refund, or offer something free. The FTC's own example is a fake Netflix email, with the real logo, saying the account is on hold because of a billing problem.

The FTC notes they can be hard to spot: in its December 2024 alert, "Phishing scams can be hard to spot," it describes messages dressed as a missed delivery notice or a problem with a streaming account.

What the numbers show

The FBI's Internet Crime Complaint Center defines phishing (its category is called "Phishing/Spoofing") as "The use of unsolicited email, text messages, and telephone calls purportedly from a legitimate company requesting personal, financial, and/or login credentials." Complaints about it from people aged 60 and over went from 2,856 in 2023 to 23,252 in 2024 and 48,064 in 2025, making it the most-reported crime type for that age group in 2025. Over the same years, phishing complaints from people of all ages fell, from 298,878 to 191,561, so, in our reading (the FBI doesn't say this), the rise among older people may partly reflect who files complaints and gives an age, not only how much phishing there is.

The one question to ask

The FTC suggests starting with: do I have an account with this company?

• If not, the FTC says it could be a phishing scam. Look for the signs of phishing above: in the FTC's words, "If you see them, report the message and then delete it."
• If you do, don't use the message to check. Open the company's app, or type its address into your browser yourself, and sign in there. A real problem will usually show there, and if you're unsure, the company can tell you. You can also call the company at a number from your statement or the back of your card.

The FTC's question covers people too: do you know the person who contacted you? If a message seems to come from a friend, check with them another way, such as a call or a new message of your own.

Read the sender's address

The name your email program shows ("Netflix," "Chase Bank," "Amazon Support") is typed by the sender and can say anything. The address after the @ tells you more, though even a familiar one isn't proof on its own. Paste the sender's address into our link checker to see its domain in plain words.

Codes are keys

Some versions skip the link and ask for the code your bank or email provider just texted you. The FBI warns that criminals posing as bank or support staff collect passwords and one-time codes to take over accounts, and that companies generally don't contact you to ask for your username, password or one-time code. The FTC: "No caller — especially someone from your bank’s fraud department — will ever ask for the verification code." If a code arrives that you didn't ask for, someone may be trying to get into your account. Don't share it, and consider changing that account's password.

Protect your accounts ahead of time

The FTC recommends four habits: use security software and let it update automatically; let your phone update automatically; turn on multi-factor authentication (a second step, such as a code, when you sign in); and back up your files. The FBI adds one more: sign in through a bookmark rather than a search result or an ad.

If you clicked or signed in

If it was your bank's password, or you also gave a code, call your bank first, at the number on the back of your card: the FBI's advice is to contact your bank as soon as you recognize the fraud. If you typed a password into a page from a message, change that password now, and change it anywhere else you used it. Turn on two-step sign-in (if it was your email, see the first-hour checklist for a hacked email). If you gave a card or bank number, call the number on the back of your card. If you gave your Social Security number, the FTC points to IdentityTheft.gov. To report the message, forward emails to the Anti-Phishing Working Group at reportphishing@apwg.org, forward texts to 7726 (SPAM), a forwarding code for spam texts rather than a number to call, and report it at ReportFraud.ftc.gov. More on our "if you clicked" page.

Related patterns

• Calls and texts from “your bank’s fraud department”A fraud alert, a code to read back, and a push to move money.
• Emails about an order, invoice or renewal you don't recognizeA big charge you didn't make, and a number to call within 24 hours.
• Texts about a package or a delivery problemA missed delivery, a bad address or postage due, and a link.