Back to Cloud-Hosted Phishing Page Scam

This is a version of Cloud-Hosted Phishing Page Scam.

Cloud-storage account deletion warning asks you to reactivate and verify your identity

An image shows a cloud-storage-style warning claiming that an inactive account is scheduled for permanent deletion. It says 4,315 photos and videos are at risk and asks the recipient to verify their identity by clicking a blue "Reactivate My Account Now" button. The image does not identify a real provider or account and uses a deletion deadline to pressure the recipient into an unsafe action.

Cloud-storage account deletion warning asks you to reactivate and verify your identity | Screenshot

What’s different in this version

These traits set this message apart from the usual pattern.

  1. The warning uses a generic cloud logo and the headline "Account Scheduled for Deletion" without naming a real provider.

  2. It claims stored files will be permanently removed on 09/09/2026 because the account has been inactive.

  3. It claims that 4,315 photos and videos are at risk and labels the status "Pending Deletion."

  4. It says the required action is "Verify Identity" and provides a "Reactivate My Account Now" button.

  5. The image was downloaded from ci3[.]googleusercontent[.]com; that hosting address does not establish who created or operates the message.

How this scam works

  1. 1

    Step 1: A message, advertisement, social post, or search result sends you to a file or page hosted on a legitimate cloud-storage service.

  2. 2

    Step 2: The page copies the name, logo, colors, or layout of a bank, courier, retailer, government office, or other trusted organization.

  3. 3

    Step 3: The page asks you to sign in, pay a fee, enter card details, share an identity number, download a file, or provide a verification code.

  4. 4

    Step 4: The submitted information may be sent to the scammer, or the download may lead to another harmful step. The hosting provider's name does not validate the page.

✓ Do this

  • Stop when a cloud-storage link opens a page asking for a password, payment, identity number, verification code, or download.
  • Open the real organization's app or type its known website address yourself.
  • Check the full web address and confirm that it belongs to the organization you intended to visit.
  • Report the page to the impersonated organization and the hosting provider, then delete the message or advertisement.
  • Contact your bank or change exposed passwords through the official service if you already submitted information.

✗ Avoid this

  • Do not assume a link is safe because it contains Amazon, Cloudflare, Backblaze, Microsoft, Google, or another familiar cloud-provider name.
  • Do not enter payment, identity, login, or verification information into an unexpected hosted page.
  • Do not download files from a page that arrived unexpectedly or claims you need an update or special viewer.
  • Do not use the suspicious page's own contact details or links to verify the offer.

Verbatim excerpts from the scam

Exact lines from emails or messages—searchable text so you can compare wording.

  1. 1 Excerpt 1
    CRITICAL ALERT
  2. 2 Excerpt 2
    Account Scheduled for Deletion
  3. 3 Excerpt 3
    Your account has been inactive for an extended period. To comply with our data privacy policy, your stored files are scheduled for permanent removal on 09/09/2026.
  4. 4 Excerpt 4
    Pending Deletion
  5. 5 Excerpt 5
    4,315 Photos & Videos
  6. 6 Excerpt 6
    Verify Identity
  7. 7 Excerpt 7
    Reactivate My Account Now