Email Phishing Alert: “Your American Express Forgotten User ID”

Recently we have seen a few emails related to the same phishing attempt make it through our email antispam filter service.

Details of the AMEX phishing email scam.

  • The email appears to be from American Express with a spoofed email address of
  • The subject line is Your American Express Forgotten User ID.
  • The links embedded in the email do not go to an American Express website. They point to a website.

If you are using Outlook, you can preview the link URL by hovering your mouse over the hyperlink before clicking.

hover over link in outlook to see URL

hover over a link in Outlook to preview the actual website address

Here is a screen shot of this particular email. If you received it or one similar to it, do not click on the the links.


screenshot of the phishing email presenting itself as “AMEX”

A word of caution when dealing with financial institutions online.

Banks and credit card companies will not ask you to verify account information like social security number, account ID, or date of birth via email. Also, if you don’t have services from the company then don’t click on the link.

  • eppand

    We are seeing another waive of AMEX phishing emails. Be on alert.

    • Joe Champagne

      I just received a similar message to this, except in my case there’s an HTML attachment they wanted me to open. Should also note that this reached my corporate email, as well; somehow it slipped through our Radiant filters.

  • Native_New_Yorker

    Just got one of these this morning!!!!

  • Seeing a lot of these in the UK under the Guise of HMRC concerning a VAT return with a nice .zip attachment as well as other financial institutions like HSBC Bank

    • They do seem to be coming more fast and furious lately. I received one yesterday claiming to be a utility bill.

      Thanks for the update from the UK!

  • wlm

    I receive notification from our system that emails from have been rejected. This happens 2 or 3 times a week.

    • eppand

      The postmaster@ emails do seem to be on an up tick. We are seeing them with an attached .zip file. An obvious fradulant email for us because we don’t utilize that mailbox for system messages.

  • DMac

    Can someone help me clear this up? I received an e-mail from this address. However, the link takes me to a site beginning with, and the phone number – 1-800-992-3404 – seems to be listed as a legit AmEx phone number when I google it. So is this address real or fake?!

    • eppand

      Dmac, we aren’t saying that the email address is a bad one or fake. In the particular case described in this blog post, the email addressed was spoofed and the other indicators help contribute to this being identified as a phishing email attempt.

      • DMac

        Apologies – I didn’t realise that spoofed meant that it could be a genuine e-mail address also? I thought this meant that it was a fake meant to resemble the real thing. Thanks for clearing that up!

        • eppand

          No problem.

      • I’m confused on this too. Are you saying that phishers are disguising their e-mail address to LOOK like the real one, or are in fact e-mailing from that address? I don’t understand how the same address can be both legit and a fraud at the same time.

        • eppand

          Yes, they are disguising their email to look like a real one. It isn’t as difficult to do as it may sound.

  • Jacqueline

    I just got one of these emails this morning from:
    The subject line was: Regarding Your Information Request
    Be careful!!

  • James Maseo Brown

    Got a number of emails from these guys

    “Security Concern on Your American Express Account”

  • AaronD12

    Interestingly, I got one of these emails today. No attachments, no links. Viewing the raw source of the email doesn’t show anything “phishy” at all… just a request to call the number on the back of my card. This email might just be legit.

    • eppand

      I would still exercise caution. Email is still a less than standard way to receive information about your account from a credit card provider.

      • Louise Gagnon Bélair

        I just received one 10 minutes ago… find it weird because usually Amex is calling not emailing….