Question
How can I spot phishing emails related to SendGrid and what should I do if I receive one? My inbox received an email using the SendGrid name, but I'm not sure if it's a scam or safe to click. What steps should I take if I think I've received a phishing email?
Product
SendGrid
Answer
Phishing emails are fraudulent messages designed to trick you into revealing sensitive information or clicking malicious links. If you receive an unexpected email claiming to be from SendGrid, look out for these warning signs:
- The email asks for your account credentials, payment information, or other personal details.
- The sender's email address looks suspicious or does not use an official domain (for example, it is not from @sendgrid.com or @twilio.com).
- The message contains urgent or alarming language, prompting immediate action or warning of consequences.
- There are unexpected attachments or links.
If you see emails from addresses like noreply@sendgrid (without a valid domain such as .com) or "SendGrid <example@some-unknown-domain.com>", this is not a legitimate sender and may be a phishing attempt. Always verify the sender’s full email address and do not trust messages from suspicious or incomplete addresses.
Known Phishing Examples and Best Practices:
-
Billing Warnings: If you receive an email about invoices, outstanding balances, or payment issues, do not click on any links in the message if you suspect it is a phishing email. Instead, log directly into your SendGrid account to review your billing status and invoices securely.
-
Webhook Security Alerts: Some phishing attempts claim there is a problem with Webhooks or mention settings changes, resulting in an interruption to your email delivery. Always log in and check your Event Webhooks via Settings > Mail Settings in your account, rather than following links in the email.
-
Unknown Endpoints and API Calls: Phishing emails sometimes reference endpoints that do not exist (for example,
/api/v1/email/send). You can always verify valid API endpoints and documentation items at SendGrid's official API Reference.
If you believe an email is a phishing attempts:
- Do not click any links or download attachments from the email.
- Do not reply to the message or provide any personal information.
- Forward the email to abuse@sendgrid.com for our security team to review.
- Delete the phishing email from your inbox.
Additional Information
For more information on securing your account after potential compromise from a phishing email, please refer to our guide: Proactive Steps for Customers Experiencing Account Takeover on SendGrid Accounts.