Yahoo! email address loss threatened.

[scottnsilky]

I've just received an email, purporting to be from Yahoo, with the heading You will Loose Email Address, ie with that spelling mistake and all capital letters except one word. This is in my inbox, I've had them previously go straight to spam. Included in the message is a link, which I haven't yet clicked. The message says I need to verify my account annually, which I have never done before, not doing so threatens it being closed.

Is this a genuine email, has anyone else had a similar one?

[pochisoldi]

Phishing attempt.

Don't click on any link, click on the spam button (assuming you are using Yahoo web access), then delete it.

[Infrasonic]

The spelling mistake and capitals would indicate it's almost certainly spam, probably a phishing attempt to get you to click on a dodgy link.

Mark it as spam and see if you can look at the message headers from there, to see where it has come from. They've probably spoofed the sent from address, but the servers and routing should give you a clue.

Also look for the bit in the headers where is mentions SPF, DKIM and DMARC and see what it says. That's the end to end verification stuff. I have seen occasional spam that can get through those SPF DKIM systems but 99% of it gets flagged as 'fail'.
Yahoo use DMARC so any genuine email from them would 'pass' that bit.

[Breelander]

Almost 100% certain this is spam.

In addition to reading the Header for clues, hover (do NOT click) the mouse over the link in the email. Your browser should show you the address it contains (at the bottom in Edge, IE, Firefox and probably most other browsers). A bit.ly (or other) encoded 'short' address would be a giveaway that this is spam trying to disguise its link, as would a full length address that points to anything other than a genuine yahoo server.

[Lootman]

Almost 100% certain this is spam.

hover (do NOT click) the mouse over the link in the email.

If I really want to see what the link or attachment says, but am suspect, I toodle down to my local library, use one of the public computers there, and click on it.

If there is a virus then it won't infect my machines. And on the odd chance it is legitimate then I get to see what it says.

Or is that anti-social?

[swill453]

If there is a virus then it won't infect my machines. And on the odd chance it is legitimate then I get to see what it says.

Or is that anti-social?

You're still allowing the spammer to succeed in one of their aims, you've just confirmed your email address is valid.

Scott.

[Infrasonic]

If you haven't already make sure your inbox has active content/graphics off by default, as that's a prime way for spammers to confirm your email address is live without you doing anything.

In Yahoo webmail settings (gear wheel) more settings/viewing email/show images in messages/Ask before showing external images.

Make sure you do that for all apps that do email, phone, tablets et al, as any of them that don't will confirm your address.

You can use disposable addresses in Yahoo too, handy for newsletter or marketing signups to avoid your real address being spread about.

Lastly, put your email address(es) into this...https://haveibeenpwned.com/ to see if you've been compromised already.
If it has that will explain large volumes of spam.

[scottnsilky]

Thanks to all who took the time to answer. Some of the replies were a wee bit too technical for me, but I agree with the consensus that it is spam. I moved it to spam, I clicked, so to speak, I'm on Android, on the reply arrow at the bottom of the email and the address turned out to be a youth club!

Thanks to Infrasonic for the haveibeenpwned link, I've checked on that before and even registered for emails to warn me if I've been compromised, it seems I have now, one breach, but I was never informed about it.

Much obliged,

dp

[Infrasonic]

Thanks to Infrasonic for the haveibeenpwned link, I've checked on that before and even registered for emails to warn me if I've been compromised, it seems I have now, one breach, but I was never informed about it.

Not necessarily, a lot of spam is just randomly generated addresses hoping people will click on them, thereby confirming the address is live and then getting you put onto the 'spam' lists which have commercial value.
It's worth taking some time to understand how it all works as that way you'll have the best chance of minimising it, if not completely stopping it.

FWIW my main aggregator hotmail address that I've had since 1999 is on that pwned site (3 times...) and it does get a fair bit of
spam.

All my other addresses which are more recent and I've been very careful with are completely spam free. So it can be done.

[BobbyD]

Almost 100% certain this is spam.

hover (do NOT click) the mouse over the link in the email.

If I really want to see what the link or attachment says, but am suspect, I toodle down to my local library, use one of the public computers there, and click on it.

If there is a virus then it won't infect my machines. And on the odd chance it is legitimate then I get to see what it says.

Or is that anti-social?

If there was a machine I thought had a chance of being compromised because people use it to check dodgy links I wouldn't be commuting to put my email and email password in to it.

[midnightcatprowl]

A simpler way to look at it all. Yahoo does not ask you to verify your email address whether daily, monthly, annually, or every 10 years. They just don't.

Lynn - who has had Yahoo email addresses for a long, long, time.