Yahoo scams
Last updated September 18, 2026
The short answer
Yahoo Mail accounts are targeted because they are old, often carry weak or reused passwords, and still act as the recovery address for bank and shopping accounts set up years ago. The scams are fake security alerts and storage warnings that capture the password.
Yahoo Mail accounts are frequently among the oldest email addresses a person owns, and that is precisely what makes them valuable. They tend to have long-forgotten passwords, no two-factor authentication, and — critically — they are still listed as the recovery address on financial and shopping accounts opened a decade ago. Yahoo also suffered historic breaches affecting essentially all accounts, so the credentials are in circulation.
How Yahoo scams work
- 1
Fake security alerts
An email or text warns of a sign-in from another country and links to a fake Yahoo login. The password is captured, and with no two-factor in place the takeover is complete.
- 2
Credential stuffing from old breaches
Passwords exposed in historic breaches are tried automatically against Yahoo accounts. Where a password was never changed or was reused, the login simply works.
- 3
Storage and closure warnings
Messages claiming the account will be closed or that mail will stop arriving unless you verify, linking to credential capture.
- 4
Recovery-address abuse
Once inside, the attacker resets accounts that use the address for recovery — banking, shopping, social — and adds filters so the reset emails are never seen.
Warning signs
- A security alert arrives by text or from a non-Yahoo address
- A login page is not on login.yahoo.com
- Contacts report messages you did not send
- Expected email stops arriving (a filter may be deleting it)
- Your sent folder contains unfamiliar messages
- A message threatens closure of the account within days
- You cannot log in and the recovery phone number has changed
Examples
The password from 2013
An account is accessed using a password exposed in a historic breach and never changed. The attacker finds a decade-old bank relationship in the archive, resets it through the email, and adds a filter deleting anything containing the bank's name. The account holder sees nothing until a statement arrives by post.
The closure warning
An email says the account will be deleted for inactivity unless verified within 48 hours. The linked page is a copy of the Yahoo login. The password is captured and used within minutes, before the user has left the page.
What to do
- Change the password and turn on two-factor authentication — Yahoo Account Key or an authenticator app.
- Check filters, forwarding rules and the recovery phone and email after any compromise.
- Audit which accounts still use this address for recovery, and update the important ones.
- Never verify an account through a link in an email. Type login.yahoo.com yourself.
- Consider migrating important accounts to a modern, two-factor-protected email address.
Report it to Yahoo
Recover a compromised account at login.yahoo.com and report phishing through help.yahoo.com.
Getting your money back
Recover the account, then check for the things a password change does not fix: forwarding addresses, filters, and altered recovery phone numbers and email addresses. Attackers change the recovery details first so they can take the account back. Then work out which financial and shopping accounts still use this address for password resets and secure those, because that is the actual objective. Turn on two-factor authentication before you finish, and warn contacts, since the address will be used to phish them next.
Frequently asked questions
Why are old email accounts targeted so heavily?
Because they usually have weak or reused passwords, no two-factor, years of archived mail describing your financial relationships, and standing status as the recovery address for accounts opened long ago. That combination makes an old, half-forgotten inbox more valuable than a current one.
I changed my Yahoo password but things still look wrong. What did I miss?
Check the recovery phone number and email — attackers change those first so they can reset the account again — and look for mail filters or forwarding rules. A rule that deletes anything from your bank survives a password change and keeps the compromise running.
Should I keep using an old Yahoo or AOL address?
It can be fine with a strong unique password and two-factor authentication turned on. What is not fine is leaving it as the recovery address for financial accounts while it sits unprotected. At minimum, secure it properly and audit what still depends on it.
Other companies scammers impersonate
Scams reuse their scripts across brands. If you were contacted about Yahoo, these are the guides worth reading next.