Your Cloud Storage Is “About to Be Deleted” — But It’s a Global Scam
Mass Email Campaign Uses Fake Payment Alerts to Push Victims into Costly Subscriptions
A large-scale cloud storage subscription scam has been targeting users worldwide through relentless phishing emails that falsely claim photos, files, and backups will be blocked or permanently deleted due to alleged payment failures.
The campaign has intensified in recent months, with victims receiving multiple variations of the same scam every day. Each message is crafted to create urgency, fear, and confusion, pushing recipients to act quickly without verifying the claim.
How the Scam Works
The emails impersonate generic cloud storage services and warn recipients that:
- A subscription renewal failed
- A payment method expired
- Storage is full or access is suspended
Victims are told that photos, videos, documents, and backups will be deleted immediately unless action is taken.
To appear legitimate, the emails often include:
- Personalized names or email addresses
- Fake account IDs and subscription numbers
- Specific dates and deadlines
Malicious Links Hidden Behind Trusted Infrastructure
All scam emails contain links that initially point to Google Cloud Storage infrastructure, where attackers host harmless-looking redirector files.
Once clicked, users are silently redirected to:
- Fake cloud storage portals
- Phony “storage scan” pages
- Fraudulent upgrade offers
This technique helps the emails bypass spam filters and appear more trustworthy.
What Victims See Next
The phishing pages falsely claim:
- Cloud storage is completely full
- Photos, Drive data, Mail, and contacts are no longer syncing
- Data loss is imminent without “urgent protection”
Every scan result is fake and always reports the same outcome.
Victims are then offered a limited-time loyalty upgrade with discounts of up to 80%, which leads not to a real cloud provider—but to affiliate marketing checkout pages.
The Real Goal: Credit Card Theft and Affiliate Revenue
Instead of restoring storage, victims are pushed to buy:
- VPN subscriptions
- Unknown “security” software
- Unrelated digital services
These purchases generate affiliate commissions for the scammers while exposing victims’ credit card details.
Why These Emails Are Convincing
- They use fear of permanent data loss
- They abuse trusted cloud branding
- They exploit urgency and fake deadlines
- They rely on users not checking official accounts directly
In reality, legitimate cloud providers do not delete data immediately after payment failures and never redirect users to third-party products to fix billing issues.
What Users Should Do
- Do not click links in these emails
- Do not enter payment details
- Delete the messages immediately
- Check storage status only by logging into the official cloud service website or app
Ignoring these emails is the safest and most effective response.