LexisNexis email scam: how to spot the fake message
Quick answer
An unexpected email that says it's from LexisNexis and pushes you to open an attachment, click a link or pay an invoice is phishing. LexisNexis has warned that fake invoice emails don't come from its systems. Don't open it, report it at reportfraud.ftc.gov, then delete it.
- Comes by
- Pretends to be
- LexisNexis
- Last updated
How it works
LexisNexis is a real data and legal research company, and scammers borrow its name because most people have heard of it but don't know how it contacts them. LexisNexis is the one being impersonated here.
LexisNexis has warned customers about fraudulent emails carrying fake invoices. It said the emails and invoices are not legitimate and don't come from its systems, and told people to delete them without opening the attachment.
The usual pattern with this kind of phishing email is the same. The message looks like a business notice: an invoice, a report, or a request to verify something. It carries an attachment or a link. The attachment can install malware, and the link leads to a fake page that asks for a login, an account number or payment details.
What the sender is after is one of three things: your password, your payment details, or access to your computer.
Red flags
- An email you weren't expecting that mentions an invoice, report or account from a company you don't deal with
- An attachment you're told to open, or a link you're told to click, to see the document
- Pressure to act fast or pay a balance you don't recognise
- A sender address that doesn't match LexisNexis's real domain
- A request to log in or confirm personal details through a link in the email
Example message
Your LexisNexis invoice is attached and payment is overdue. Open the attached document to review the charges and settle your balance today to avoid a late fee. Or sign in here: [link]
What to do
- 1
Don't open it
Leave the attachment closed and don't click the link. Don't reply, even to say stop.
- 2
Check with the company directly
If you think you really do have an account, go to the company's website by typing the address yourself, or call a number you find there. Don't use the contact details in the email.
- 3
Report it, then delete it
The FTC says to forward phishing emails to the Anti-Phishing Working Group and to report the attempt at ReportFraud.ftc.gov. Delete the message afterwards.
- 4
If you opened the attachment
Run a security scan on your device and change passwords for your email and any accounts you use on it. Use a different device to change them if you think it's infected.
- 5
If you entered a password or paid
Change the password everywhere you've used it and turn on two-step verification. For a payment, call your bank or card issuer using the number on your card and tell them it was fraud.
Report it
Check if your details are exposed with Serus
Scammers find your number and address on data brokers and people-search sites. Serus removes them.
Why you got it
Phishing emails are cheap to send, so many go out in bulk. They land better when they carry your real name or a company you recognise. Names, email addresses and phone numbers circulate on people-search sites and in data breaches, and scammers use them to decide who to target.
Serus finds where your details are listed and removes them from data brokers and people-search sites, and alerts you when your email shows up in a breach. That means fewer scammers can build a message that looks written for you.
Frequently asked
Is LexisNexis a scam?
No. LexisNexis is a real company, and scammers pretend to be it. Its own warning says fake invoice emails don't come from its systems.
I got an email with a LexisNexis invoice I don't recognise. What now?
Don't open the attachment or click anything. Report it at ReportFraud.ftc.gov and delete it.
Can I check if an email really is from LexisNexis?
Don't use anything in the email. Go to the company's website by typing the address yourself and look for its contact page.
I clicked the link. Am I in trouble?
Not necessarily. If you didn't enter anything, close the page and run a scan. If you typed a password, change it everywhere you use it.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
