Subject: Your AAA Emergency Kit Could Be Gone Tomorrow

The Hook: This email uses AAA branding and a "Free Gift" offer to trick users into clicking a malicious link. It creates a false sense of urgency by claiming the offer "could be gone tomorrow."


Why it’s Malicious:

  • Fake Sender: The email address is a random onmicrosoft.com account, not an official @aaa.com domain.
  • Malicious Links: Hovering over the buttons reveals a suspicious website (segmarola.digital) that has nothing to do with AAA.
  • Identical Links: Both the "Get Kit" and "Unsubscribe" buttons lead to the exact same destination, which is a major red flag.

Image Placeholder

How to Spot the Red Flags:

1. Check the Sender's Email Address
While the "Sender Name" says "AAA Member Services," the actual email address is center-4776005@regionalcitizens.onmicrosoft[.]com. A legitimate email from AAA would come from an official domain such as @aaa.com. Scammers often use onmicrosoft.com or other free/unrelated domains because they are easy to set up.

You can verify the sender's email address by clicking on their user profile icon:
Image Placeholder 

2. Inspect the Destination URLs
Bad actors often hide malicious URLs by inserting a hyperlink on a button or link that looks fine at first glance. They are hoping that you either select the "Get Your Free Kit Now" button, or the Unsubscribe button at the bottom of the email. 

It's important that we inspect every link before clicking (Whether on an email, webpage, or other place you may receive a link from). 

When hovering over the "Get Your Free Kit Now" button, we see a link that leads to a destination unrelated to both the URL itself, and the email. 

Image Placeholder

When hovering over the Unsubscribe button, we can see that the URL is actually the exact same URL as the button above, which is a huge red flag. 
Image Placeholder


3. Identify Psychological Triggers
Phishing emails almost always rely on specific tactics to bypass your critical thinking: 

  • Urgency: The subject line, "Your AAA Emergency Kit Could Be Gone Tomorrow" and the text "Offer ends soon" create a "fear of missing out" to make you act quickly without checking the details. 
  • Too Good to Be True: A completely free car emergency kit with "shipping & handling covered" and "no purchase necessary" is a common "bait" tactic to lure victims.

4. Verify Through Official Channels
If you receive a similar email from someone claiming to be from a company you are a current a customer of, it might not trigger any red flags for you, as it's somewhat an "expected email". For emails like this, never click the link in the email. Instead, you should:

  • Navigate directly to the company's website in your browser.
  • Log in to their official member portal to check for related notifications or pages.
  • Call the customer service number to confirm the validity of the email you received.

What should you do if you see emails like this?

  1. Do Not Click: Even clicking "Unsubscribe" can alert the attacker that your email address is active, or redirect you to a malicious site.
  2. Report It: Use the Phish Alert button in your Outlook toolbar. This sends a copy of the email to us, allowing us to review the email, inform you of what our findings are, and block the sender if needed to prevent spread.
Image Placeholder