One hacker is already exploiting Twitter’s reported plan to charge users for the verified blue checkmark by using it as a lure in phishing emails.
On Monday, journalists at TechCrunch and NBC News received phishing emails that pretended to come from Twitter, and claimed they had to submit some personal information in order to keep the blue checkmarks on their Twitter accounts.
“Don’t lose your free Verified Status,” the phishing email says. Twitter itself has yet to officially announce any changes about the blue checkmark. Nevertheless, the phishing email tries to exploit the news by claiming that some verified users, particularly celebrities, will need to pay $19.99 per month after Nov. 2 to keep the status
The email then tries to create a sense of urgency. “You need to give a short confirmation so that you are not affected by this situation,” it says. “To receive the verification badge for free and permanently, please confirm that you are a well-known person. If you don’t provide verification, you will pay $19.99 every month like other users to get the verification badge.”
The email provides a button labeled “Provide Information.” However, a closer look at the message reveals it was sent from the email address Twittercontactcenter@gmail, instead of an official Twitter domain—a clear red flag the message is a fake.
Clicking the button also leads the user to a Google Doc page—another clear indicator that the message is fake—before sending the user to another Google site, according to TechCrunch. The Google site then asks the user to submit the Twitter account username, password, and phone number, giving the hacker an easy way to break into an account.
The phishing email wouldn’t have tricked tech-savvy Twitter users. But it could have fooled other users scared about losing their verified status, and who are happy to pay up, even though Twitter still hasn’t announced whether it’ll charge for the blue checkmark or not.
The incident is a reminder to be careful around emails that look like they came from an official tech company. Last week, other users, including staff at PCMag, received a separate phishing notification on Twitter that claimed the company was revoking their blue verified checkmark because their account had been found to be “inauthentic.” The message then tried to trick victims into visiting the hacker’s website in order to appeal.
According to The Verge, Twitter’s new owner Elon Musk has given his employees until Nov. 7 to launch a feature to charge for the verified blue check through Twitter Blue. In the meantime, we wouldn’t be surprised if more hackers refined their phishing attacks to exploit the news.