Do not reply to the Fund Release scam email

What is "Fund Release email scam"?

Scammers often use email as a channel to trick people into providing sensitive information (e.g., login credentials, credit card details, social security numbers), sending money and installing malware onto their computers. Scammers usually disguise their emails as important, official messages from legitimate companies.

They use the names of well-known entities, logos, names of real people, take advantage of real events, etc., to add authenticity to their emails. This email is disguised as a message regarding fund release - scammers spread with the aim to extort money from recipients.

"Fund Release" email scam overview

Scammers spread an email claiming that South Africa's First National and United Kingdom's Investment Standard banks have received authority from the America's Federal Reserve Bank, International Monetary Fund (IMF), and The World Bank to "release" pending lottery winnings, contract payments, inheritance funds, loan payments, ATM card claims, and other pending payments.

Their main goal is to trick recipients into believing that one of the banks has their banking details and that recipients need to confirm if those details are correct. In this way, scammers attempt to trick recipients into providing their credit card details.

It is likely that scammers may ask to pay a "transaction" or "processing" or some other fee (pay upfront fees for "financial services", which are never provided). Therefore, this is either a prepayment scam or a phishing email and, therefore, cannot be trusted.

Scammers could use provided details (credit card details) to steal identities, make fraudulent transactions, purchases, or to sell them to other cyber criminals. Typically, when recipients fall for these scams, they lose money, become victims of identity theft, and encounter other issues relating to finances.

Similar spam campaign examples

More examples of similar scams are "INTERNATIONAL MONETARY FUND (IMF) Email Scam", "U.S Army Special Operations Command Consignment Email Scam", and "EMPLOYEE BENEFITS Email Scam".

Most claim to be emails from legitimate companies, organizations, or other entities, and ask to provide personal information or make small payments. Note that email can also be used as a channel to deliver malware.

How do spam campaigns infect computers?

Phishing emails that are used to deliver malware generally contain a download link for a malicious file or attachment. Typically, cyber criminals attempt to trick recipients into opening a PDF or Microsoft Office document, JavaScript file, an executable file (.exe), ZIP, RAR, or other archive file that is designed to install specific malicious software.

Note that malicious MS Office documents can install malware only when users enable editing/content (macros commands). If the documents are opened with MS Office versions prior to 2010, however, the documents install malicious software automatically, since these older versions do not include "Protected View" mode.

How to avoid installation of malware

You are advised to research all software before download/installation. Use only official and verified download channels. Unofficial and free file-hosting websites, Peer-to-Peer sharing networks (BitTorrent, Gnutella, eMule), and other third party downloaders commonly offer harmful and bundled content, and are therefore untrusted and should be avoided.

When downloading/installing, read the terms, study all possible options, use the "Custom/Advanced" settings and opt-out of additional apps, tools, features, and so on.

Intrusive advertisements typically seem legitimate, however, they can redirect to dubious and malicious sites (e.g. gambling, pornography, adult-dating, and many others). If you encounter ads or redirects of this kind, inspect the system and remove all dubious applications and browser extensions/plug-ins immediately.

Installed programs must be activated and updated with tools or implemented functions that are provided by the official developers. No other third party, unofficial tools should be used.

Note that it is illegal to activate licensed software with ‘cracking’ tools. Files and programs should be downloaded from official websites and via direct download links. Avoid third party installers and the tools/sources mentioned above.

Do not open website links or files in irrelevant emails that are received from unknown, suspicious addresses. These bogus emails are often disguised as official and important. Regularly, scan your computer with reputable, up-to-date antivirus or anti-spyware software.

If you have already opened malicious attachments, we recommend running a scan with Combo Cleaner Antivirus for Windows to automatically eliminate infiltrated malware.

Text presented in the Fund Release scam email:

Subject: Fund Release

Attention:
 
Note that the First National Bank of South Africa, Investment Standard Bank of the UK has received the authority by United State America Federal Reserve Bank in-conjunction with the International Monetary Fund (IMF) and the World Bank to finally release all pending Lottery winning payments, Contract's payments Inheritance funds, Loan payments, ATM card claims and all pending payments.
Most importantly, we have received banking details for the transfer of funds, as such we urgently request that you reconfirm with us if you have given such mandate or not, failure to receive an immediate response from you within the next seven workings days, we shall believe that such mandate was issued by you, to that effect, we shall then commence with the transfer of the fund into the bank details that had been provided.
 
 
We are taking the necessary precautions to fight the spread of the COVID 19, we want you to rest assured that there are plenty of ways to stay safe while still enjoying everything that First National Bank of South Africa and Investment Standard Bank UK has to offer.
 
 
Regards,
 
Mr. Collins Hills
First National Bank of South Africa
Sandton City Complex, Cnr Rivonia Road
and 5th Street, Sandton,
Johannesburg, South Africa
Tel: +27-632696383

Other examples of fund release-themed spam emails:

Sample 1:

Text presented within:

Dear Beneficiary

In regard to the new elected United States Mrs kristalina Georgieva.
Our unit has been appointed by the President to investigate and
release all withholding fund held during the office of the former
president Donald Trump. We came to a conclusion to release your funds
to you however; our investigation has confirmed that your fund U.S $8
Million United States Dollars is legitimate.

This decision was made after several investigations carried out few
days ago. We understand that you still have it in mind to receive your
funds, we advise that you follow our procedure so that we release your
funds to you.

Please provide the following Details for identity reconfirmation.

*Your Full Name:

*Your Resident Address:

*Your Home & Cell Number:

*Your Date Of Birth:

*Your Occupation:

*Copy Of ID: Driver's license (Front & Back) Or Passport

We will provide you with further details on the release of your funds
only after we have reconfirmed the above listed information.

Please send all information to this EMail:  Mrdavidmorris1718@gmail.com
my Whatsapp phone number +13189255380

Sample 2:

Text presented within:

Subject: Dear Esteemed Customer, Its My Pleasure Contacting You Today.!

 

Dear Esteemed Customer,

We are writing to inform you that due to the delay in your response we have finally agreed to release your Fund to the Indian Bank for immediate transfer to any personal bank account of your choice and after the prestigious board of trustees meeting held on Thursday last week the transaction was approved and we have transferred your fund to our afflicted Bank Of India Head Office New Delhi India. So kindly contact  Reserve Bank Of India (RBI) on the details below with all your details such as Receiver's Name, Current Address,Telephone  #, e-mail ID and account details of your choice where the Fund US$2.850 Million will be transferred to.

Below are their contact details:
(RBI Bank)
RESERVE BANK OF INDIA (Foreign Transfer Unit).
Address: 6 Sansad Marg, New Delhi - 110001, India.
Contact Person: DR. S. R. PARAKH
General Manager, Foreign Transfer Unit.
E-Mail: ( rbibnki.org.in@gmail.com )

Kindly contact the  Reserve Bank Of India (RBI) Director Dr. S. R. Parakh as soon as you have received this mail today because i have forwarded all your details to them and they will be waiting for you to contact them in regards to the transfer of your Fund to your personal bank account without any delay.

I wait for your update as soon as you have received your Fund from the Reserve Bank Of India.

Sincerely~~~
Committee Secretary General
Federal Ministry Of Finance
Mr. Lewis George.

Sample 3:

Text presented within:

Subject: Delinquent Contract Pay-Out ACC/1130/922/9803/US

Greetings

Acting Director of the Federal Bureau of Investigations Christopher A. Wray with the Officials from the FBI In the nation's capital, the is attempting to wiretap

The Federal Bureau of Investigation (FBI) in Washington, D.C., in conjunction with other pertinent investigative agencies, was recently notified through our worldwide intelligence monitoring network that your delinquent contract payment, for which the Central Bank  had properly certified you in good standing, had not been claimed.

You might be interested to know that we actually went through this process and made sure that your contract payment was real and there were no problems with it at all. You have the legal right to get your money right away.

Also, you should go ahead and deal with the Central Bank office as planned, since we will be keeping an eye on all of their services and your communications at all levels. We were also made to understand that a lady with the name Mrs. Joan C. Bailey from OHIO has already contacted them and also presented to them all the necessary documentation evidencing your claim purported to have been signed personally by you prior to the release of your contract fund, but the Central Bank office did the wise thing by insisting on hearing from you personally before they go ahead with wiring your fund to the bank information that was forwarded to them by the above-named lady, which was the main reason why they contacted us so as to assist them in making the investigation.

Immediately communicate the following information to the office of the governor of the Central Bank of Malaysia (Bank Negara Malaysia) via email:
Name:Shaik Abdul Rasheed Abdul Ghaffour
Bank Negara Malaysia, Jalan Kuching,
Wilayah Persekutuan, Kuala Lumpur,
Selangor, Malaysia,
Email:shaik1ghaffour@gmail.com.

Please call the Governor of the Central Bank right away at the above email address and ask them to take care of your payment file as instructed to ensure you can get your contract fund.

In order to ensure the processing and release of your funds with confidence and to prevent us from being held liable for any incorrect payments, you are required to verify and authenticate the information provided below.

COMPLETE NAMES: _________________________
CITY: _____________________________
ZIP: _____________
COURT NATION ____________________________
SEX:___________
FAX: __________________________
Age: _______________
Telephone Number: _____________________

You should fulfill all their processes as requested to speed up the transfer of your funds to you. Additionally, bear in mind that the Central Bank of Malaysia operates according to its own protocol, which is detailed in its banking terms; therefore, any delay could be extremely hazardous.

We sincerely appreciate your anticipated cooperation in advance and are eagerly anticipating your prompt response to this issue.

Sincere Regards,

Christopher Wray Director, (Federal Bureau of Investigation),
935 Pennsylvania Avenue Northwest, J.
Edgar Hoover Building,
Washington, D.C.

Sample 4:

Text presented within:

Subject: To ******** Shaik Abdul Rasheed Abdul Ghaffour Await Swift Responds

 

Greetings!********

FBI Director General Christopher A. Wray with FBI Officials Attempting a Wiretap at the Nation's Capital.

Your late contract payment, confirmed in excellent condition by the Central Bank, has not been claimed. The FBI in Washington, DC, and other appropriate authorities were informed of this via our worldwide intelligence monitoring network.

You might be interested to know that we actually went through this process and made sure that your contract payment was real and that there were no problems with it at all. You have the legal right to get your money right away.

Also, you should go ahead and deal with the Central Bank office as planned, since we will be keeping an eye on all of their services and your communications at all levels. Mrs Alice Rodriguez from Florida has already contacted them and presented all the necessary documentation evidencing your claim, purportedly signed by you prior to the release of your contract fund, but the Central Bank office did the right thing by insisting on hearing from you before wiring your fund to the bank information forwarded to her.

Email the governor of the Central Bank of Malaysia (Bank Negara Malaysia) immediately:
Shaik Abdul Rasheed Abdul Ghaffour
Bank Negara Malaysia, Jalan Kuching,
Wilayah Persekutuan, Kuala Lumpur,
Selangor, Malaysia,
Email:shaik1ghaffour@gmail.com.

Call the Governor of the Central Bank at the aforementioned email address immediately and ask them to handle your payment file as advised to collect your contract money.

To process and release your cash confidently and avoid liability for improper payments, you must check and authenticate the information below.

COMPLETE NAMES: _________________________
CITY: _____________________________
ZIP: _____________
COURT NATION ____________________________
SEX:___________
FAX: __________________________
Age: _______________
Telephone Number: _____________________

Please complete all their requests to speed up your money transfer. Remember that the Central Bank of Malaysia follows its own process, which is stated in its banking conditions, so any delay might be detrimental.

We appreciate your early cooperation and greatly await your timely solution to this matter.

Best regards,

--
Christopher Wray Director, Federal Bureau of Investigation,
935 Pennsylvania Avenue Northwest, J.
Edgar Hoover Building,
Washington, D.C.

Sample 5:

Text presented within:

Subject: URGENT

Greetings.

I came across your e-mail contact prior to a private search. I am really in need of your kind assistance in realizing a deal. My name is Mr.Abas Bin Omer , and I am working at the Auditing and Accounting department here in my Bank. There is a fund that was kept in custody of my Bank years ago and I need your assistance for the transfer of this fund to your bank account for the benefit of both of us for lifetime investment and the amount is Twenty Three Million Five Hundred Thousand United States Dollars (US$23.5 Million).

I have made every inquiry about the money and I have full proof details to make the Bank authority believe you are beneficiary of the fund and will release the fund to your bank account within 7 working days upon submitting a claim application to the Bank. With your full cooperation with me I can get the Bank to transfer the money to you, and after the successful transfer of the money to your Account we can share the amount 40% for you and 60% for me.

Below you will see the list of information that I will need from you.
-Your Telephone Number
-Your Residential Address:
-Your Passport or ID card (scan copy)

Please reply to me if you accept this Business deal I proposed to you.

Thanks,
Mr. Abas Bin Omer,
Tel/WhatsApp: +22667777005
My Address: BP 1288, Sector 17,
Ouagadougou, Burkina Faso

Sample 6:

Text presented within:

Subject: Hello..

Hello,

I hope this message finds you well. My name is Chawla Manoj, and I reside in Dubai, UAE. I serve as a senior officer at Emirates NBD in Dubai. You can learn more about me and my role at the bank through this link: -

Five years ago, one of our esteemed clients, a prominent politician from Africa, entrusted us with a significant fixed deposit of $400,000,000 USD for a duration of 60 calendar months, which equates to 5 years. Regrettably, I recently received news of his passing two years ago. Consequently, the deposit, which matured this past January 2023, remains unclaimed.

I am reaching out to you with a unique opportunity. I propose presenting you as the deceased client's next of kin, facilitating the release of the funds to you.

Should you be interested in exploring this opportunity further, please do not hesitate to contact me. I assure you that engaging in this arrangement will be mutually beneficial.

Looking forward to your response.

Best Regards,
Chawla Manoj
Email: (manojchawla1940@gmail.com)

Sample 7:

Text presented within:

Subject: REPLY BACK (ASAP).

 

Your Attn:,
 
I am Capt. Jane B. Woods, an American Combat Soldier group of 2,500 combatant, left behind in Iraq for advisory and assistance to Iraq Forces after the handing over to Iraq PeaceKeeping Force.
I need you to help receive some funds that were discovered during one of our last operation, awaiting release proceedings from Baghdad. Kindly review below links as source of funds:
-
I do hope you are going to give me your trust in carrying out this venture for our mutual benefit, it's a 100% risk free project but details must be kept in confidence since I am still in service.
I will provide you with more details upon receipt of your response, on how we'll realize the safe release of the funds without breach of law. I look forward to your urgent reply.
 
Regards,
Capt. Jane B. Woods
Baghdad, Iraq. -

Sample 8:

Text presented within:

Subject: GET BACK TO ME

ATTENTION,
My name is Mr.Mohamed Hadi, a Bank official.
A late investor/Business man of our bank died in Kahramanmaras earthquake of 2023 disaster in Turkey,
Along with his family On 6 February 2023 and left a substantial amount in our bank without a WILL.
I searched for you and decided to contact you and present you as the next of kin to the deceased customer.
I have put in place all necessary documentation concerning the release of this deposit and it is my intention to introduce this opportunity to you based on the fact that you can assist with the transfer and investment plans of my share of the funds. Since nobody is coming for this deposit and I am one hundred percent sure this is no known relative. I have all the proper documentation to instill you as the next of kin. All I require is your honest cooperation to enable us to achieve this transaction.
Upon your acceptance to cooperate, I want you to know that 40% of this deposited fund will be yours as our foreign partner, while 60% will be for me and my partner here in the office.
If you are interested, please contact me via email,
Upon your response, I shall then provide you with more details and relevant documents that will help you understand this transaction properly.
However, if this business proposal offends your moral ethics, do accept my sincere apology, or if on the contrary, you wish to achieve this goal with me, kindly get back to me with your interest for further explanations.
Kindest Regards,
Mr. Mohamed Hadi K

Sample 9:

Text presented within:

Treasury Department Office,

I am Mr Michael Robert Stephen from the United States Department of the Treasury. I'm truly sorry if you receive this important message in your spam box due to the IP and mail delivery settings. This urgent message is to inform you that the newly appointed Secretary of the United States Department of the Treasury Mr. Scott Bessent, has approved the immediate release and delivery of your fund to you

During the file verification exercise as directed by the newly appointed Secretary of the Treasury, He came across a payment file in your name. This file has all the payment approval documents, especially from the United Nations Payment Agency as well as other agencies including US agencies. However, there is no indication that the said approved fund was finally paid to you as the beneficiary. Your total fund is US$4,500,000 million (four Million Five Hundred Thousand United States Dollars only).

All you will need to do right now is to text all the required info to Mr Michael Robert Stephen for final verification so that the attorney can forward you all the legal back up paperwork for your fund for the immediate delivery of your fund to you

Immediately contact Mr Michael Robert Stephen and reconfirm your shipping address to get this letter for a final inspection to ensure that you must receive your fund immediately today and avoid losing your fund.

Your Full Names:
Your Country:
Your City:
Your Home address:
Age:
Telephone / Mobile phone:
Occupation:
ID:
Email Address:

You need to avoid any further delay and respond back to me as soon as possible

Mr Michael Robert Stephen

Sample 10:

Text presented within:

Subject: Re: Fund Release Notification

From the Desk of Mr. Scott Bessent
U.S. Department of the Treasury
1500 Pennsylvania Avenue, NW
Washington, D.C. 20220

Attention Beneficiary,

This letter is legitimate. While it is wise to exercise caution, please understand that I am not contacting you to extort or defraud you. Rather, I am writing to guide you through the necessary procedures and requirements involved in the release of your funds.

As a public official, I have taken an oath to serve and protect our nation, uphold the Constitution, preserve liberty, and enforce the rule of law. Therefore, I will never act contrary to that oath. I can assure you that you will receive your funds once you comply with the required procedures and instructions.

I am contacting you because the United States Department of Justice and the Federal Bureau of Investigation (FBI) have instructed us to proceed with the release of your unclaimed funds following discussions regarding the terms and conditions of the release. According to the information provided by the relevant authorities, your funds were not released previously because certain requirements for processing the release had not been fulfilled.

We are now prepared to proceed with the release of your funds. To facilitate this process, you are expected to cooperate fully with the appropriate U.S. authorities for the endorsement and approval of your fund release. Once the endorsement process is completed, which is expected to take approximately 24 hours, your funds held with the Federal Reserve Bank of New York will be released to you.

Kindly provide the following information:

* Full Name:
* Current Residential Address:
* Mobile Phone Number:
* Private Email Address:
* Alternative Email Address
* Next of Kin's Email Address:
* Occupation:
* Scan Copy of Your Valid Government-Issued Identification Card:

Please do not hesitate to contact me if you require any further information or clarification.

I look forward to hearing from you as soon as possible.

Sincerely,

Mr. Scott Bessent
United States Secretary of the Treasury
Alternative Email: bs.mt@msn.com

Sample 10:

Text presented within:

Subject: Re:Notice Of Funds Transfer

FEDERAL RESERVE BANK of NEW YORK
33 Liberty Street, New York, NY 10045
OFFICIAL MEMORANDUM
DATE: August 14, 2026
FROM: Office of the Board of Governors
REF: International Transaction Settlement / Allocation Code: US/A84FRB2026

Hello ********

Pursuant to the resolutions adopted during the Executive Board Session on August 11, 2026, clearance has been granted for the remittance of the designated allocation totaling $4,700,000.​00 USD.​
In accordance with federal banking regulations and standard clearinghouse protocols, these funds are scheduled for release through our designated correspondent institution, Financial Union Bank.​
To initiate the statutory account creation and facilitate the secure electronic transfer of these assets to your local depository, please verify and submit the following credentials to the processing office:

Full Legal Name:
Primary Residential Address:
Telephone Number:
Government-Issued Identification:

Upon administrative verification of the requested documentation, the correspondent institution will issue your secure online banking credentials.​
Respectfully submitted,
Kevin Warsh

Chairman, Board of Governors

Federal Reserve System

Instant automatic malware removal:

Manual threat removal might be a lengthy and complicated process that requires advanced IT skills. Combo Cleaner is a professional automatic malware removal tool that is recommended to get rid of malware. Download it by clicking the button below:

By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. To use full-featured product, you have to purchase a license for Combo Cleaner. 7 days free trial available. Combo Cleaner is owned and operated by RCS LT, the parent company of PCRisk.com.

Types of malicious emails:

If you opened an attachment or downloaded a file from a suspicious email, run a full system scan with Combo Cleaner. If you only received the email and didn't engage with it, you don't need to scan anything - just identify the scam and delete it. The full procedure below covers both situations and what to do if you already clicked, replied, or sent money.

Credential theft Phishing emails

Fake login pages disguised as PayPal, Microsoft, Apple, banks, or social networks. The email pushes a link to a near-perfect copy of the real login screen. The moment you type your username and password, the attacker has them.

Common subject lines

• "Action required: confirm your account"
• "Your password expires today"
• "Unusual sign-in attempt detected"
• "Verify your billing information"

Malware delivery Emails with malicious attachments

Trojans hidden inside fake invoices, faxes, shipping confirmations, or Office documents. Opening the attachment runs the payload and infects the system - often with an info-stealer or remote-access trojan.

Common subject lines

• "Invoice INV-2026-XXXX attached"
• "Fax received - 3 pages"
• "Your shipping document is ready"
• "Voicemail from +1-XXX-XXX-XXXX"

Extortion Sextortion emails

Fake claims of webcam recordings demanding cryptocurrency. Almost always a bluff: the attacker pulls a real password from an old data breach to make the threat look credible, then claims to have video of you. They have no recording and no access.

Common subject lines

• "I know your password is XXXX"
• "Your account has been hacked"
• "I have recorded you - 48 hours to pay"
• "You have been compromised"

Callback fraud Refund & callback scams

"Your subscription was renewed for $499 - call to cancel." Norton, McAfee, Geek Squad, PayPal, and Wells Fargo variants are all common. There's no real subscription. The phone number in the email connects directly to the scammer, who walks you through "refunding" yourself - which is actually them stealing money from your bank.

Common subject lines

• "Norton subscription auto-renewed - $499.99"
• "McAfee Total Protection invoice"
• "Geek Squad order confirmation"
• "Your PayPal payment is being processed"

Credential theft Account suspension & verification scams

"Your account will be deleted in 24 hours - verify now." The artificial deadline is the whole point: it pressures you to click before checking details. The "verify" link goes to a phishing page styled to look like the real provider.

Common subject lines

• "Your account will be deleted in 24 hours"
• "Suspicious activity detected - verify now"
• "Final warning: account closure"
• "Action required to keep your account active"

Mixed payload Delivery & package scams

Fake DHL, USPS, UPS, or FedEx tracking, customs fees, or "package undeliverable" notices. Targets anyone expecting a parcel - the timing alone catches many people. The link hides either phishing (asking for card details to "release" the package) or a malware download.

Common subject lines

• "Your DHL package is held at customs"
• "USPS - delivery attempt failed"
• "FedEx tracking update - action required"
• "Pay $2.99 redelivery fee to release your parcel"

Remote access Tech support scams

Fake Microsoft, Apple, or "Windows Defender" security alerts pushing a phone number. Real Microsoft and Apple never email a phone number to call. The number connects you to a scammer who asks for remote access to "fix" the imaginary problem and then demands payment.

Common subject lines

• "Microsoft Defender expired - renew now"
• "Apple ID security alert"
• "Critical: virus detected on your PC"
• "Windows license expired - call now"

Wire fraud Advance-fee scams

Inheritance, lottery wins, romance, or business deals that ask for a small fee to release a much larger sum. The classic "Nigerian prince" 419 family of frauds. Once you pay the first fee, more fees appear (taxes, lawyer, transfer charges) until you stop paying. The promised money never exists.

Common subject lines

• "Inheritance from a relative you didn't know about"
• "You won the international lottery"
• "URGENT - business proposal worth $XX million"
• "Compensation fund release for fraud victims"

Wire fraud Business email compromise (BEC)

CEO impersonation asking employees to wire money or buy gift cards, or fake supplier invoices with newly "updated" bank details for payment redirection. The email often spoofs a real internal executive's display name and uses an external lookalike domain.

Common subject lines

• "Quick task - need you to buy gift cards"
• "Updated banking details for invoice payment"
• "Wire transfer request - urgent"
• "Are you available?" (CEO impersonation opener)

How to spot a malicious email?

Phase 1~ 2 min

Spot - identify the red flags

---

1

Check the sender's actual address, not the display name

30 sec

The display name (the human-readable part) is trivial to fake. Always check the full address that comes after it. Common red flags:

• Domain mismatch - service@paypa1.com, support@micros0ft-help.com, look-alike domains using digits or extra hyphens
• Free-email impersonation - any "official" message from a bank, courier, or platform sent from a @gmail.com, @outlook.com, or @yahoo.com address
• Reply-To mismatch - the From address looks legitimate but Reply-To points somewhere completely different

Why this matters

Real companies own their domains and send mail from them. A "DHL" message from a Gmail address is never legitimate, regardless of how convincing the body looks.

2

Watch for urgency, threats, and generic greetings

30 sec

Scams almost always rush you. The point is to make you act before you think. Treat any of the following as a strong signal:

• "Your account will be deleted in 24 hours"
• "Final notice" / "Immediate action required"
• "Dear Customer" or "Dear User" instead of your real name
• Threats of fines, account closure, legal action, or arrest
• Promises of refunds, prizes, or money you didn't earn
• Spelling and grammar mistakes in messages claiming to come from a major brand

3

Hover over every link before clicking

30 sec

On a desktop, hover the mouse over the link without clicking. The real destination shows in the bottom-left status bar of your browser or email client. On a phone, long-press the link to preview the URL.

• Real Microsoft, PayPal, or bank links go to those exact domains, not redirects through unrelated sites
• Shortened URLs (bit.ly, tinyurl, t.co) hide the real destination - never click them in unsolicited mail
• The visible link text and the actual URL must match - mismatches are the single biggest phishing red flag

Pro tip

When in doubt, don't click the link. Open a new browser tab and type the company's address yourself, then log in normally. If there really is an issue with your account, you'll see it there.

4

Treat unexpected attachments as hostile

30 sec

If you didn't ask for the file, don't open it - even if it appears to come from someone you know. Categories that should never be opened from email without verification through another channel:

• .exe, .scr, .iso, .img, .vbs, .bat - executables, never legitimate attachments
• .docx, .xlsx, .pptx with "Enable macros" prompts - the macros run the malware
• .pdf with "Click here to view" buttons - usually a phishing redirect, not a real document
• .zip, .rar, .7z archives, especially password-protected ones - the password defeats the email scanner

Phase 2~ 2 min

Report and delete - if you haven't engaged

---

If you only received the email and didn't reply, click, or open anything, the steps below are all you need. Your computer is not infected.

5

Don't reply, don't click "unsubscribe"

30 sec

Replying confirms your address is real and monitored, which gets you added to higher-value scam lists. The "unsubscribe" link in a scam message is rarely a real opt-out - it usually leads to a phishing page or downloads a tracking pixel.

Instead, mark the message as junk or phishing inside your email client (this trains the spam filter), then block the sender.

6

Report the scam to your email provider and authorities

1 min

Inside your email client:

• Gmail: open the message → ⋮ menu → Report phishing
• Outlook / Outlook.com: ⋯ menu → Report → Report phishing
• Apple Mail / iCloud: Move to Junk, then forward to reportphishing@apple.com

Forward or report to authorities:

• International: forward to reportphishing@apwg.org
• United States: ic3.gov (FBI)
• United Kingdom: forward phishing emails to report@phishing.gov.uk (NCSC SERS); for financial loss report at reportfraud.police.uk (Report Fraud, the successor to Action Fraud; 0300 123 2040)
• Canada: antifraudcentre.ca
• Australia: scamwatch.gov.au
• EU: your national CERT - find yours via the ENISA CSIRT map

After reporting, delete the email and empty the Trash folder so you don't accidentally open it later.

Phase 3~ 10–60 min

Recover - if you already engaged with the scam

---

Pick the step below that matches what you did. If multiple apply, work through them in the order they appear - the steps are arranged from lowest to highest risk.

7

You only clicked a link (didn't enter anything or download anything)

Scenario: clicked link only10 min

Close the page right away. Don't enter any information, even if the page looks legitimate.

• Clear your browser cache and cookies for the last hour - Chrome/Edge: Ctrl+Shift+Del → Last hour → check Cookies and Cached files
• Run a quick scan with Combo Cleaner in case the page tried to drop a file silently (drive-by download)
• Update your browser to the latest version - most drive-by exploits target outdated browsers
• Watch for new browser pop-ups, redirects, or unfamiliar notifications over the next few days

Why this matters

Modern browsers block most drive-by attacks, but a single click on a phishing page can still be enough on an outdated browser or unpatched plugin. A quick scan catches anything that landed silently.

8

You opened an attachment or downloaded a file - run a full malware scan

Scenario: opened attachment⚠ Highest risk60–90 min

Opening an attachment is the most common path to actual infection. Treat the system as compromised until the scans below come back clean. Work through these sub-steps in order:

8.1Disconnect from the network

Unplug Ethernet and turn off Wi-Fi. If the attachment was an info-stealer or remote-access trojan, this stops it from sending data out or receiving commands. Keep the network off until you've booted into Safe Mode (next step) - you'll reconnect there briefly to download the scanners.

8.2Boot into Safe Mode with Networking, then download the scanners

Windows 11: Settings → System → Recovery → Advanced startup → Restart now → Troubleshoot → Advanced options → Startup Settings → Restart → press 5 or F5.

Windows 10: hold Shift, click Power → Restart → Troubleshoot → Advanced options → Startup Settings → Restart → press F5.

Once Safe Mode has loaded, turn Wi-Fi back on and download Combo Cleaner (used in 8.4) and Microsoft Safety Scanner (used in 8.5). Safe Mode loads only minimal drivers, so most malware can't auto-run while you're getting the tools. Save both installers to your Desktop.

8.3Run Microsoft Defender Offline

Reboot to normal Windows. Open Windows Security → Virus & threat protection → Scan options. Select Microsoft Defender Antivirus (offline scan) and click Scan now. The PC restarts into a stripped-down environment and scans the disk before Windows fully loads - this is what catches rootkits and bootkits.

Recommended antivirus

Combo Cleaner

VB100 certified. Includes anti-trojan, registry/persistence scanning, and anti-spyware in one pass. The 7-day free trial is available.

Download Combo Cleaner

8.4Run a full Combo Cleaner scan

Install Combo Cleaner and run a full system scan (not the quick scan). Let it complete fully, review what it found, and apply the recommended actions. Combo Cleaner will quarantine known trojans and remove their persistence in the registry.

8.5Run Microsoft Safety Scanner as a second-opinion scan

Download Microsoft Safety Scanner (MSERT.exe). The binary expires every 10 days, which means every download has the latest signatures. Run a full scan after Combo Cleaner to catch anything one engine alone might miss.

8.6Reset browsers and clear notification permissions

Many email-borne trojans drop adware that hijacks browsers. Reset each browser you use:

Chrome: chrome://settings/reset → Restore settings to their original defaults. Then chrome://settings/content/notifications - remove unfamiliar sites.

Edge: edge://settings/reset. Then edge://settings/content/notifications.

Firefox: about:support → Refresh Firefox.

8.7Re-enable Defender, Tamper Protection, and update everything

Open Windows Security → Virus & threat protection → Manage settings and confirm Real-time protection, Cloud-delivered protection, and Tamper Protection are all on. Then run Settings → Windows Update → Check for updates and update browsers and applications.

Important

If the scans keep finding new threats on each run, or files reappear after deletion, you may have a deeper compromise that needs a clean Windows reinstall. See pcrisk's full manual malware removal guide for the extended procedure (Process Explorer, Autoruns, hosts file inspection).

9

You entered credentials on a fake login page

Scenario: shared password⚠ Act fast20 min

Assume the attacker has your password and is using it right now. Speed matters.

1. Change the password from a different, known-clean device (your phone is fine if it's not infected). Don't reuse the old password anywhere else.
2. Enable two-factor authentication if you haven't already. Prefer an authenticator app or hardware key over SMS.
3. Sign out of all sessions - most platforms have a "sign out everywhere" option in security settings, which kicks the attacker out.
4. Review recent activity - look for unfamiliar logins, new devices, forwarding rules, or app permissions. Remove anything you don't recognize.
5. Check your other accounts - if you reused that password anywhere else, change it there too. Check your exposure at haveibeenpwned.com.
6. Update security questions - the attacker may have seen the answers in your account profile.

Why email comes first

If you only have time to change one password, change your primary email password - it's the recovery hub for every other account. An attacker who controls your email can reset everything else.

10

You sent money or shared bank, card, or ID details

Scenario: financial loss⚠ Contact bank now30 min

Time is the single biggest factor in recovering money. Banks can sometimes recall a wire or reverse a card transaction within the first few hours.

1. Call your bank or card issuer immediately. Use the number on the back of the card, not any number from the scam email. Ask them to freeze the card, reverse the transaction if possible, and flag the account for fraud monitoring.
2. If you sent a wire transfer or used a money-transfer service (Western Union, MoneyGram, Zelle, Wise), call them directly and request a recall. Some can be reversed within minutes if reported fast.
3. If you sent cryptocurrency or gift cards, recovery is unlikely - but report it anyway, since law enforcement tracks these patterns.
4. File a police report. You'll need the report number for any insurance, bank, or credit-bureau claim. Save the report number.
5. File with the right authority for your country:
   • US: ic3.gov + reportfraud.ftc.gov
   • UK: reportfraud.police.uk (Report Fraud, the successor to Action Fraud; 0300 123 2040)
   • Canada: antifraudcentre.ca
   • Australia: scamwatch.gov.au
   • EU: your national CERT or police cybercrime unit
6. Set fraud alerts on all major credit bureaus if you shared any ID details. US: Equifax, Experian, TransUnion. UK: Experian, Equifax, TransUnion (Cifas Protective Registration is a stronger option).
7. Save all evidence - the original email (with full headers), screenshots of the fake site, transaction records, any phone numbers or chat logs.

Phase 4~ 15 min + 30 days

Verify & monitor

---

11

Final scan and startup-app check

15 min

Reconnect to the network and run one final full scan with Combo Cleaner, followed by a Windows Defender quick scan. Then open Task Manager (Ctrl + Shift + Esc) and switch to Startup apps - disable anything unfamiliar.

Make sure Windows, browsers, and any applications you use are fully up to date. The infection vector that worked on you once usually involves outdated software.

12

Monitor accounts and credit for 30 days

5 min/day · 30 days

Most fraud follow-ups land in the first month. Until that window closes, keep watching:

• Bank and card statements - daily for the first week, then weekly
• Email - watch for password-reset confirmations or login alerts you didn't trigger
• Credit report - US: free at annualcreditreport.com; UK: Experian, Equifax, TransUnion all have free tiers
• Breach alerts - sign up at haveibeenpwned.com to be notified when your email appears in new leaks

If anything new appears in any of those, treat it as a continuing compromise: change passwords again, contact the bank again, and update the police report.

Important: If you didn't click anything, didn't reply, and didn't open any attachment, your computer is not infected - just delete the email and move on. If you opened an attachment or downloaded a file, run an automated scan with Combo Cleaner and Windows Defender and stop there. That path catches the vast majority of email-borne malware without the risk of breaking Windows by deleting the wrong file.

Frequently Asked Questions (FAQ)

Why did I receive this email?

Cyber criminals distribute spam emails in large-scale campaigns – therefore, thousands of users receive identical messages.

I have provided my personal information when tricked by this spam email, what should I do?

If you have provided your account credentials – immediately change the passwords of all possibly exposed accounts and inform their official support. However, if the disclosed information was of a different personal nature (e.g., ID card details, passport scans/photos, credit card numbers, etc.) – contact the corresponding authorities without delay.

I have read a spam email but didn't open the attachment, is my computer infected?

Devices are infected when malicious attachments or links are opened; merely reading an email is harmless.

I have downloaded and opened a file attached to a spam email, is my computer infected?

If the opened file was an executable (.exe, .run, etc.) – most likely, yes – since these formats cause infections almost without fail. However, you might have avoided compromising the system if it was a document (.doc, .xls, .pdf, .one, etc.). Document formats can require additional interaction (e.g., enabling macro commands, clicking embedded files/links, etc.) to start downloading/installing malware.

Will Combo Cleaner remove malware infections present in email attachments?

Yes, Combo Cleaner is capable of detecting and eliminating practically all known malware infections. It must be stressed that performing a full system scan is essential since high-end malicious software typically hides deep within systems.