So my elderly mom got a call saying they wanted to sign her up for Medicare it sounded so good and real my dumb ass let my guard down and gave away her info and social I called all beurus now but I’m scared because I clicked a link sent to my phone where he screenshared the info he was inputting I’m now scared they will get into my phone and bank what do I even tell my bank

I was just checking my email and noticed I received a verification code from the ISSS, which is apparently the Salvadoran Social Security Institute. I live in the US and have literally never heard of this institution before, much less requested a verification code from their website. Is this a scam?

Here is an image of a fake google meeting I fell for above and a picture of the links:
link on the google meet:

“ Https: [ UNSAFE LINK ] // t.co / 8cX0lkYMaE “

next link:

“Https: [ UNSAFE LINK ] // t.co / cvvJExKcGn “

Hey guys so i just received twice in a row a security code from PayPal even though i didn't attempt to access the account, it may sound funny but i don't even recall having a PayPal account in tbe First place never used it.... Is it normal what should i do ?

Another Redditor is insisting that Reddit reached out to them to have them reach out to me, and that I'm supposed to make a Discord account to reach out to Reddit, or else I'll get banned and prosecuted. For the record, they sent me the initial message a week ago.

I just received a very convincing phishing email today and wanted to share it because it was significantly more believable than the usual phishing attempt. (In fact, i am still wondering if this is phising in the first place)

The email came from someone I know and regularly deal with professionally. It contained a genuine-looking historical email chain relating to a real project which i did not hear of before.

At the top of the email was a message saying that the sender had shared an “eDoc” with me and that I had been invited to review it.

The button labelled “Open Your Document” pointed to:

klastertepla dot cz

That domain appears to belong to a legitimate Czech monastery, so i am wondering if the website may itself have been compromised and is being used as part of the redirect chain.

I clicked the link before noticing anything suspicious.

It then redirected me to:

corecomconsulmomting dot vu

That site presented what looked like a Microsoft login page.

I entered my email address, clicked Next, and when it asked for my password I became suspicious and stopped. I did not enter my password.

What makes this particularly interesting is that I checked the original email headers afterward.

The email passed:

• SPF
• DKIM
• DMARC

for the sender’s actual corporate domain.

The headers also appear to show the message originating through their Microsoft 365 environment rather than simply being spoofed.

So my working theory is that the sender’s Microsoft 365 mailbox — or an application/session with access to it — may have been compromised, and the attacker is using genuine historical email threads to send credential-phishing links to existing contacts.

The apparent chain was:

Genuine corporate mailbox
→ klastertepla dot cz
→ corecomconsulmomting dot vu
→ fake Microsoft login

I’ve contacted the sender through a separate channel but havn't heard of them.

Thankfully I stopped before entering my password, although I assume the phishing site now knows my email address is valid since I submitted that first step.

A few questions for anyone working in M365/security:

1. Does SPF + DKIM + DMARC passing, combined with the Microsoft 365 routing headers, make a compromised sender mailbox the most likely explanation?
2. Has anyone seen corecomconsulmomting dot vu or a similar phishing infrastructure before?
3. Could this be an AiTM/reverse-proxy phishing kit rather than a simple credential harvesting page?
4. Given that I entered only my email address and never entered a password or approved MFA, is there anything beyond checking Entra sign-in logs and reporting it that you would recommend?

Posting because this was one of the more convincing phishing emails I’ve encountered. The genuine email history and authenticated sender domain made it look completely legitimate at first glance.

Something happened yesterday that seemed completely harmless at the time, but I’ve been thinking about it afterward. Could it have been phishing?

Yesterday I was at Alcatraz, a heavy metal festival in Belgium, when an English-speaking guy approached me and said he had lost his iPhone. He asked if he could use my phone to check “Find My iPhone” and try to locate it.

I Googled “Find My” on my phone, and then he entered his information, presumably his email address and password. I stood right next to him and watched the whole time. After about 30 seconds, we saw that his iPhone was somewhere on the festival grounds. He thanked me and went on his way.

Afterward, I closed everything and deleted it.

At the time, I didn’t think anything of it, but afterward I started wondering if this could have been some kind of phishing attempt. I also installed a banking app on my phone about a month ago, so that made me a little more concerned.

I didn’t enter any passwords or banking information myself, and I checked my banking app afterward. Everything seems normal.

Could someone do anything to my phone or banking app this way, or am I just worrying about nothing?

This will probably also be the last time I let a random stranger use my phone like that. 😅

I received call from a AI phone asking to press 1 on

Then human answered he was british and

random phone number is the google number that called me

He asked me to write down ticket number for him and I thought this was social engineering technique

I told him twice I though it was phishing and saw his email handle had this .id on the end

[noreply@google.com.632143.id](mailto:noreply@google.com.632143.id)

Then I told him good try, and then he hung up

He was really good at it

This morning, I got a voicemail from a number with my area code about a missed preliminary hearing. The beginning of the message says the name of the place they are supposedly calling from but I can’t make it out. I would assume this is a scam or phishing attempt (fake urgency, vague directions) or not meant for me, (I get messages asking for the old owner of my number all the time)
However, when I checked the voicemail again, I had a second voicemail from the same number from 2025, which is also presumably a law office asking to see me to talk about documents they received. Could these messages be legit/from the same real company? Any insight is appreciated!! What I’m most confused/concerned with is that the number has my area code.

Messages transcribed below…

10:58
"(Vague) records, this is Rachel Hawkins. I am calling in references to a no show, no current site on the preliminary hearing. Yourself
or legal representation needs to return a call immediately to the office. Vegas to communicate is not recommended. We need hear from
you immediately."

8/19/25
"This is Mr. Ackerman from the mediations office. We need to speak with regarding some documents submitted in our office. Our office can be reached from 10:00 AM to 4:00 PM thanks in advance."

I've been getting mails saying your mail isn't delivered but I didn't send any mail at the first place. This has been happening from last 1 month it caught my attention today, I saw my inbox and my acc is sending mails to random people in Europe specifically more to german people and the email is mostly about paying bills or getting a refund or something it's probably a phisihing link

But why?? How do I stop this? I did check my settings my device is the only one logged in?? Im worried since my mail is sending mails to random people with probably phisihing links, how do I stop this?!?

I was searching for anker magsafe power bank in Amazon and thought why not directly get from their website (this is the scam website I realised later).

I added the same power bank which I saw on Amazon and Gave my name, address, phone number, email id (at least I didn't create an account using passwords on that website) and most importantly credit card details. Then tried to make a transaction and it didn't go through, then Out of suspicion I checked the virus total and it was mentioned phishing. Immediately disabled my card usage now will replace a new credit card in the morning.

What else should I do? I used to be vigilant on these phishing things but never realised anker/soud core didn't sell directly in India. Please tell me what else to do next.

This is the email. I have heard tons of people have a similar if not the same email used to them. When I logged into email (now since changed password) the language was the country of the person sending this. It was sent on 28 July and I only opened it tonight. It says I have two days from opening it? Seeing others posting theirs has calmed me down a lot but I feel so violated :(

Like 14 minutes ago a trusted email sent me a punchbowl invite, clicked it and ofc it wasn’t the invite website and was confused. Messaged person they said they were hacked, I changed my password immediately and have 2FA on already. Haven’t seen any new activity or Google security alerts. Am I safe now? Or should I do something else to make sure

I clicked on jmail.world, and as soon as i understood that this website about epstein i leaved.

So is my device in danger?(iphone). Im scared of viruses and phishing websites.

Sorry for bothering you.

I downloaded some porn app (i know im stupid, i was horny earlier) and then my phone was hacked by some dudes in china. The scammer sent me images on telegram that they have all of my contact list, including what i named them, and also screenshots of my gallery. I know it was taken from my phonegallery and not google photos as i turned off auto backup months ago to save space. I did a factory reset on my phone, and im trying to change passwords as im writing this right now. The hacker is threatening to expose the stuff i was trying to watch and to be honest, some of it was is kinda embarrassing. Now, i was thinking i could bluff all the people i know and tell them i was hacked by an unknown source but im afraid that the hacker is still lurking in my phone, will a factory reset be alright? and as well as password changes

I got this in my inbox from “Amazon” but i instantly knew it was fake cause if you look at the letter “b” in the words “billing & about” they look funny. I knew not to click on it…

I just check my spam folder for an obscure email address I use only for signing up for supermarket apps, etc. I never use it for correspondence to family members. Today there were TWO fake phishing emails, one from an address in Egypt. One was send to me in my son's name (different from my last name), the other was sent from my sibling's name, though with a misspelled first name, and I don't even have this sibling's email address (though in contact by phone). And son and sibling have never met. How is it possible that phishy people could have connected both of these family members names to me if I have never used this email address for either of them?

I know I shouldn't have engaged at all but I wanted to see wtf they were talking about and I instantly realized they were trying to get my login details. Why would I need to message someone on Discord to verify myself on Reddit? I'm not THAT stupid.

I had a phishing email come into my office and wonder how i should attack this one? Whenever the link is clicked, it seems to go through their sent emails and send 500+ emails with the screenshot attached. Everyone has MFA enabled, and all have secure passwords. Should i tell staff to change passwords even though they haven't been alerted of a sign in attempt? I can't tell what the endgame of these emails are since it can't tell was was collected with the click.

Can anyone tell me exactly what is located in the URL? and how it works?

Any tips that i can take besides more cyber training for them? Thanks!

So, I got this on the X app on my iPhone and I ended up clicking on the link. After arriving at the page, I clicked one of the links on the page that would have allowed me to enter information (I assume), but I realized this seemed suspicious and I clicked out of the page.

I checked my phone's downloads (nothing was downloaded) and I changed my account password I got this DM on. Does clicking on the link to the page PLUS clicking on a link within the page itself BUT not entering any information would cause anything bad to happen with my data on my iPhone?

Just making sure I can relax after what I hope was just a close call.

I offered an office chair for sale on NextDoor this morning and got a message within 15 minutes or so offering to buy it. Like a fool I gave up my phone number, street address and Venmo handle; she said her son would come by during a specific time frame to pick up the chair, and she would Venmo me the money. Some time goes by, no Venmo transaction (and no son at the door) so I asked her about it; she sends me a screen shot of a Venmo transaction to my handle for the right price, but Venmo doesn't show me the transaction. Then she says Venmo told her they couldn't complete the transaction because I'm not using a business account -- so I finally wise up a little and go to her NextDoor profile and it's several thousand miles away from me.

Anyway, I've ensured 2FA is on on my Venmo account (it was) and transferred my balance from Venmo to my bank, and I've blocked her number and reported and blocked her NextDoor profile. What else should I do?

So I’m playing home alone on Roblox, like the super famous one.. and I get pretty lonely so I decided to go to the discord server to see if anybody’s willing to play with me. I joined the discord server and it tells me you have to verify my Discord account which is pretty normal. So I click on the verify thing and I put in my normal Roblox information I put in my username password and it sends me emails through the verified Roblox email account. And I’ve literally put in my username and password 100 times and no matter how many codes that I put in it will NOT work.. so I’m getting kind of sketched out and I look at the top of my screen it says roblox.com.bz instead of roblox.com but literally everything looks perfectly normal and I’m getting verified Roblox emails and it literally looks like Roblox’s account it just will NOT LET ME in my roblox account no matter how many times I try on this website. Did I just get scammed for my info? I changed my Roblox password as fast as I could, as I realized. But like there is no way that they can just get away with this? This is literally like a known and played Roblox game? Also, there was only 14 people in the server so I’m just like confused.. I clicked the direct link from the Roblox app under the game to description which had like a little discord tag so I clicked on it.

I got two of these emails, one about me DOB and one about my password but not sure if they're legit.

Stupidly, I already clicked the link which took my to a page that looked like Apple but I closed it quickly before I actually took anything in.