Remove “WeTransfer – The transfer you received expired” email

The “WeTransfer – The transfer you received expired” email is a phishing attempt. The email is made to appear like a notification from WeTransfer, a service that allows users to send large files. The email claims that a transfer you have received has expired, but you can recover it before it’s permanently deleted. Engaging with the email and clicking on the provided link will lead you to a phishing site that asks for your email account password. If you enter your password, it will be sent directly to malicious actors operating this phishing campaign. They might then attempt to take control of your email account.

 

 

The “WeTransfer – The transfer you received expired” email claims that if you click on the provided “Recover Your Transfer Now” button, you will be able to restore the transfer that has supposedly expired. The cybercriminals operating this phishing campaign are targeting users randomly and are expecting them to be curious enough to engage with the email. However, clicking the button will redirect you to a phishing site designed to mimic the Gmail website, though the attempt is very poor. This site will present a login window with your email address pre-filled. If you enter your password, it will be sent to the malicious actors running the phishing campaign. Without multi-factor authentication protecting your account, these actors could gain full access to your email account.

Email login credentials are common targets because these accounts are extremely valuable to cybercriminals. Many users retain the same email address for years, rarely deleting old emails, which means there is a lot of personal information on them. And this data can be exploited by malicious actors for blackmail. What’s more, email accounts are often linked to numerous other accounts, which means access to the email account is a gateway to all connected accounts as well.

The full text from the “WeTransfer – The transfer you received expired” email is below:

Subject: The transfer you received expired, but you can still recover it!

The transfer you received expired, but you can still recover it!

Dear ********,

The transfer you received has expired but there’s still time: recover it now or it will be permanently deleted.

Click the link below to restore your transfer and keep better control over your files in the future. Once your transfer is gone, it’s gone for good…

Recover it now by clicking the button below:

Recover Your Transfer Now

The WeTransfer Team.

To make sure our emails arrive, please add noreply@wetransfer.com to your contacts.
About us · Help · Legal

How to recognize a phishing/scam email?

Detecting a phishing email is often simpler than it may appear, unless the attempt is particularly sophisticated, which is uncommon if you’re a regular user. One of the primary indicators to watch for is poor grammar and spelling mistakes. Generic phishing emails are usually full of them. For example, the “WeTransfer – The transfer you received expired” email contains several blatant mistakes and awkward phrasing that immediately reveal its malicious nature. Whenever you receive an email prompting urgent action, such as opening an attachment or clicking a link, carefully check the contents for any mistakes.

It’s also very important to check the sender’s email address. Even if it looks credible, be skeptical, as scammers can create convincing email addresses with relative ease. If the address appears random or contains an unusual combination of letters and numbers, it is likely malicious. Trustworthy companies do not use unprofessional-looking email addresses to communicate with customers. In the case of the “WeTransfer – The transfer you received expired” email, the phishing attempt is very obvious because the sender’s email address is completely random.

Lastly, it is generally safer to avoid clicking on links in emails altogether. If an email requests that you address an account-related issue via a link, it is better to access the account manually by typing the URL into your browser, rather than risking a click. While this approach may seem overly cautious, it significantly reduces the likelihood of falling victim to phishing scams.

What to do if you clicked on the link in the “WeTransfer – The transfer you received expired” email scam?

If you’ve interacted with a suspicious email, you need to secure your accounts. If you entered your password on a phishing site, change it right away. If you can still access your account, review account activity after updating your password, terminate any unfamiliar logins, and enable multi-factor authentication if it’s not already set up. If you can no longer access your email and recovery options don’t work, make sure to disconnect the email address from all linked accounts.