Your Email Password Expires Today!

How it works

An urgent email claims your Microsoft 365 or Google account will be disabled unless you click a link and verify your password.

The link leads to a pixel-perfect copy of the real login page. Some kits now relay your password and MFA code to the real site in real time, so even the second factor doesn't save you.

Red flags

• A deadline of today or "within 24 hours"
• A sender address that is close to, but not exactly, your provider's
• A link whose real destination differs from the text when you hover

If it already happened

If you already clicked and signed in: change that password now, from the real site, and turn on multi-factor authentication. If you sent money, call your bank immediately; wire and ACH recalls work best in the first hours. Tell your IT provider so they can check for forwarding rules and other sign-ins on the account.

Where OpenEFA fits

OpenEFA MailGuard blocks most of these before they reach an inbox. The ones that get through are usually the most carefully targeted, which is why your people still need to know the pattern.

Part of the OpenEFA MailGuard Scam Watch series. Published October 21, 2026 by the EFA Security team. Share it freely; a link back is appreciated.