MalwareTips: fake AT&T 'payment could not be processed' emails sent users to card-stealing form on framer.website

What happened

In a post dated October 24, 2026, MalwareTips warns about emails impersonating AT&T that claim a payment could not be processed and steer customers to a counterfeit payment-information form. MalwareTips says the reported form collects name, billing address, phone number, card number, expiration date and card security code, and that one reported destination is direct-tv-att-management.framer[.]website; another version of the message threatens disconnection after a 48-hour grace period. MalwareTips notes AT&T is a real provider and Framer a legitimate website platform that does not endorse the page, and that the reported host now shows a site-not-found screen. It advises checking any balance through the official AT&T app or a separately opened account and checking bank records rather than trusting the email or the form's confirmation.

How the scam works

The message relies on an everyday billing problem. Cards expire, banks decline transactions and people forget which services use an old card, so updating payment details can feel routine. The 48-hour disconnection threat adds pressure. The form then asks for a name, billing address, phone number and full card details, including the security code, which is enough for criminals to make purchases or sell the card. A confirmation screen afterwards doesn't show that any bill was paid.

The page was hosted on a subdomain of Framer, a legitimate website builder, which makes the address look less suspicious than a random domain. MalwareTips says Framer doesn't endorse the page, which now shows a site-not-found screen. If you entered card details, contact your card issuer to block the card, and watch statements for charges you don't recognise. AT&T is impersonated and is not involved.

Source

MalwareTips, "AT&T Payment Could Not Be Processed Email Scam: Fake Billing Alert Exposed" (published 24 October 2026).