Scam of the Week: Phishing Email Scam Exposed

Scam of the Week: Phishing Email Scam Exposed

At The Smith Investigation Agency Inc., we are committed to keeping you informed and protected from scams. This week, we are exposing a phishing email scam that landed in our inbox, posing as a security notification from “T-W Cryptocurrency LTD.”

Breaking Down the Phishing Scam

Red Flag #1: Suspicious Email Address

While the display name of the sender appears as “T-W Cryptocurrency LTD,” hovering over it reveals the actual email address: mahmoudhosni12963.gmail.com@send.vpcontact.com. This is an immediate red flag. If a company claims to be legitimate, its email domain should match its business name, not some random string of characters. This is a common trick used in phishing scams.

Red Flag #2: No Account with This Company

A critical rule of thumb—if you don’t have an account with a company, you should be suspicious of any email claiming to have urgent security concerns about your account. Since we have never heard of “T-W Cryptocurrency LTD,” this email was an instant red flag. Crypto scams often rely on fake warnings to panic users into taking immediate action.

Red Flag #3: The Email is One Big Image

Legitimate companies use properly formatted emails, often created using email marketing services like Constant Contact or Mailchimp. However, this scammer attempted to mimic an official email campaign by embedding all the text and design into a single image. This is a common phishing attack strategy.

The scammers are even so bold as to save the image they are using to scam victims and title it “Thanks.”

Dissecting the Phishing Email Scam

Fake Branding and Logo

The phishing email starts with a blue and green shield logo with the word “Trust” next to it. A transparent attempt to gain credibility and mislead recipients into believing this is from a reputable company.

Also notice how anytime they use logos they are always blurry. 

Phony Security Warning

The body of the phishing email, which is actually part of an image, reads:

“Important Security Notification from Trust Wallet
Dear User,
This message concerns your Trust Wallet account.
Our systems have identified a potential breach of your recovery phrase.
To ensure the safety of your assets, we strongly recommend generating a new recovery phrase through our system immediately upon receiving this notice.”

The email attempts to create a sense of urgency, pressuring the recipient into clicking a link and “generating a new recovery phrase.” However, clicking on this link could lead to credential theft, malware installation, or loss of funds—a textbook example of an online scam.

Fake Link Tricks in Phishing Scams

The email includes a fake button that says “Generate New Recovery Phrase.” Unlike a legitimate email from a financial service, this isn’t an actual button—it’s part of the image. If you right-click and copy the link, you can see it leads to a suspicious URL:

https:/ /u29222857.ct.sendgrid.net/ls/click?upn=u001.qFn-2BYDnXM3-2BC8glbAvVVuCrkqf8Gg7iHLETGSAdzWbBw91bD71oHmY2LtBgoHdkruPkg_ZRnXHW-2FUocLWLrf8lrpBEaFb0jHiRH2iMnhWhIQq8WnmOgzYpElmYL3o-2BI0Q5DN5SMYqjf9xeY0S6lwm-2FUEZ4Sy2z30BQCs5ieo1IM90cK2tbHT4zN9xLgxdjQgP0A3cWdBPGxggW3STydndIbcfUbmwCtBh2uJ2SA0hcmebBbzxS3iXijGQkzxI59Uj9m2122xpbdJ4alHBdP77-2BFZp1A-3D-3D

If you click this link, you could be redirected to a fake site designed to steal your credentials or install malware on your device. This type of phishing attack is designed to steal financial information and access to cryptocurrency wallets.

More Red Flags to Watch For in Phishing Emails:

• If you don’t have a cryptocurrency account, dismiss the email immediately.
• If an email is just a low-resolution, pixelated image instead of properly formatted text, it’s likely a phishing scam.
• If it sounds too urgent or too good to be true, it’s a scam.
• If the grammar and wording seem unnatural or off, be cautious—this is common in email spam and phishing email examples.
• If the email address does not match the company name, delete and report it.

What To Do If You Receive a Phishing Email

1. Do NOT click on any links or buttons.
2. Hover over the sender’s email address to verify if it matches the display name.
3. Mark the email as spam and delete it.
4. Report the phishing scam to the Canadian Anti-Fraud Centre.
5. Stay informed by following our YouTube channel, where we expose scams and teach you how to stay safe from fraud.

Watch Our Scam Awareness Video on Phishing Attacks

We’re adding a video breakdown of this phishing scam so you can see firsthand how scammers operate and what you should do to protect yourself. Check out our YouTube channel for more phishing email examples and fraud prevention tips!

At The Smith Investigation Agency Inc., we believe knowledge is power—stay informed, stay safe, and don’t let scammers take advantage of you!

Stay tuned for next week’s Scam of the Week!