Workflow: Managing suspicious phishing tickets asking for an immediate action

<p>If your account allows anyone to submit tickets, abusive actors can use your support channels to send emails to convince your agents to act immediately.</p><p>These emails can impersonate real organizations, such as Zendesk, and use urgent language to lure agents to click links and share sensitive data.</p><p>The workflow includes:</p><div style="margin-bottom: 20px; text-align: right;">
<button id="master-toggle" class="btn fw-semibold text-dark" data-action="expand" style="background-color: #DEF991; border: none; outline: none; border-radius: 7px; padding: 10px 20px; font-size: 15px; transition: background-color 0.2s ease;" onmouseover="this.style.backgroundColor='#cbef6d'" onmouseout="this.style.backgroundColor='#DEF991'">
Expand all tabs
</button>
</div>
<script>
document.addEventListener('DOMContentLoaded', function () {
const toggleBtn = document.getElementById('master-toggle');

toggleBtn.addEventListener('click', function () {
const action = this.getAttribute('data-action');
const headers = document.querySelectorAll('.accordion');

headers.forEach(header => {
const isActive = header.classList.contains('active');
const panel = header.nextElementSibling; // Grabs the corresponding .panel container

if (action === 'expand' && !isActive) {
// Open it by simulating a standard click
header.click();
} else if (action === 'collapse' && isActive) {
// Close it by simulating a standard click
header.click();
}
});

// Flip button text and states
if (action === 'expand') {
this.setAttribute('data-action', 'collapse');
this.textContent = 'Collapse all tabs';
} else {
this.setAttribute('data-action', 'expand');
this.textContent = 'Expand all tabs';
}
});
});
</script><div class="accordion"><h3 id="h_01K8N1034N52XZCDY8TK87750Y">Check the real sender of these tickets</h3></div><div class="panel">
<p>When a ticket appears in your account, open the user profile tab in the ticket to view the sender details:</p>
<p><img class="wysiwyg-image-resized" style="aspect-ratio: 642/638; width: 31.77%;" src="https://support.zendesk.com/hc/article_attachments/9880350617498" alt="Check the details of the user profile" width="642" height="638"></p>
</div><div class="accordion"><h3 id="h_01K8N1034PQHKJRWEYBQKH5K98">Check the language used in the ticket</h3></div><div class="panel">
<p>Templates that these abusive actors use often include typos. They usually contain an urgent call to action that differs from other emails from that organization.</p>
<p>Common email subjects include:</p>
<ul>
<li data-list-item-id="edd4db0ca7fbbb7bf6f13a74480f8c934"><code>Account Suspension Notice</code></li>
<li data-list-item-id="e34738047b0dbeae036f8267ad15f4f3d"><code>Verify your account to prevent suspension</code></li>
<li data-list-item-id="efe18ca3ef987e68b6e5abd5d770012e9"><code>Your account will be suspended</code></li>
<li data-list-item-id="e63be4704d20f40cf7c2b424cb4fadfec"><code>Update your billing details</code></li>
</ul>
<p>Common patterns in the email body include:</p>
<ul>
<li data-list-item-id="ea4298cc7ce1c27e5e66224a3d374664d">Excess use alerts, for example, data storage and API calls</li>
<li data-list-item-id="e60082c86615d56aaf00c5675b6f1042f">Threats of access loss unless you complete specific steps</li>
<li data-list-item-id="e0c66a01e70a564e2d96e45a61242d7b1">Immediate calls to action to restore access</li>
<li data-list-item-id="e66e1c8cf49c51edd0849d451f5e72f4b">Buttons or links that lead to fake signin pages</li>
</ul>
</div><div class="accordion"><h3 id="h_01K8N1034P62M6WF4301JV09WN">Mark the ticket as spam to suspend the requester</h3></div><div class="panel">
<p>To mark a ticket as spam:</p>
<ol>
<li data-list-item-id="e364814532aa1efb0780a3236e4d70f84">Open the ticket you want to <a href="https://support.zendesk.com/hc/en-us/articles/4408842999066-Marking-a-ticket-as-spam-and-suspending-the-requester" target="_blank" rel="noopener noreferrer">mark as spam</a>
</li>
<li data-list-item-id="e3cbc67f3cde86f07298e377d5d36d078">
<p>Click the <strong>Ticket options</strong> menu in the upper right, then select <strong>Mark as spam</strong></p>
<p><img class="wysiwyg-image-resized" style="aspect-ratio: 606/674; width: 29%;" src="https://support.zendesk.com/hc/article_attachments/9880382262938" alt="Mark a ticket as spam" width="606" height="674"></p>
</li>
<li data-list-item-id="ebe522838e110adc84a6d0403cf8fee69">Click <strong>Immediately mark as spam</strong> to delete the ticket</li>
</ol>
<p>If you're not sure the sender is legitimate, contact <a href="mailto:abuse@zendesk.com" target="_blank" rel="noopener noreferrer">abuse@zendesk.com</a> and attach the <code>.eml</code> file of the email you received.</p>
</div><div class="accordion"><h3 id="h_01K8N1034QEA8TQ0FJE7D854HW">About email fraud</h3></div><div class="panel">
<p>If you allow anyone to submit tickets through all support channels, your account can receive unwanted or abusive tickets.</p>
<p>Because users don't need prior verification to submit tickets, abusive actors can use your support email to impersonate Zendesk or other organizations. For a more secure option, see <a href="https://support.zendesk.com/hc/en-us/articles/4408883658906-Permitting-only-added-users-to-submit-tickets" target="_blank" rel="noopener noreferrer">Permit only added users to submit tickets</a>.</p>
<div class="p"><div class="note important">Important: Zendesk will never ask for credentials through email or request customers to click links to verify their account.</div></div>
</div>