Deceptive phishing email targets Maya users with hidden redirect trick

• Photo from Pixabay

A highly deceptive phishing email circulating online is attempting to compromise user accounts by posing as a security alert from Maya, according to a recent incident posted by Scam Watch Pilipinas Co-founder and TechWatch PH Editor-in-Tech Art Samaniego on his Facebook page.

The email claims that a “new device” has been successfully registered on the recipient’s account and urges the user to click a “Remove-Devices” link if the activity was unauthorized. While the message appears urgent and legitimate at first glance, cybersecurity red flags quickly emerge upon closer inspection.

Instead of directing users to an official Maya page, the embedded link uses a technical redirect technique. A legitimate-looking NBA support domain is followed by an “@” symbol and a link shortener, which ultimately sends the victim to a malicious site. Clicking the link leads to a fake Maya login page designed to steal credentials.

“ The message claims that a new device was successfully registered and provides a ‘Remove-Devices’ link for her to click if the activity was unauthorized,” Samaniego said.

“However, this is a dangerous trap as the link uses a technical redirect trick where a legitimate-looking NBA support domain is followed by an @ symbol and a link shortener (s[.]id), which secretly sends you to a malicious site instead,” Samaniego added.

Other warning signs were also present. The sender’s address used a likely compromised educational email domain rather than an official @maya.ph address. 

Samaniego explained that the message relied on a generic greeting based on the user’s username instead of a real name—another common phishing tactic. Security experts also note that legitimate financial institutions do not use link-shortening services for account alerts.

Users are strongly advised not to click links in suspicious emails—even those that appear to come from trusted brands. Instead, customers should open the Maya app directly to check logged-in devices and verify account activity.

“To stay safe, never click on links within suspicious emails (or in Maya’s case even the official link or email from them). Instead, open your Maya app directly to manage your logged-in devices and verify any account activity. If you encounter a similar scam, report it immediately to the 1326 National Anti-Scam Hotline,” said Samaniego.