Phishing email example · Tactic: Scarcity
Groupon phishing email example: fake expiring voucher
This Groupon phishing email warns that a Jiffy Lube voucher expires in seven days and asks you to click View Details. The tell is the sender, grouponsupport@daily-points.org, which is not a Groupon domain. It works because nobody wants to lose money they already spent.
The red flags
- Subject
- Groupon Expires Soon
- From
- grouponsupport@daily-points.org
- 1
The sender domain
daily-points.org is not Groupon. The “grouponsupport” name in front is just a label.
- 2
A deal you don’t remember
If you never bought a Jiffy Lube voucher, the email is not for you, whatever it says.
- 3
A countdown
“There are still 7 days to use your Groupon” is scarcity pressure: act now or lose it.
- 4
Sloppy details
Missing punctuation (“Need help Have feedback”) and stray symbols (“Already used this Groupon>”) are small signs of a copied template.
Why this Groupon scam works
It references a specific, ordinary purchase (an oil change) and a specific deadline. Even if you don’t remember buying it, “you still have 7 days” makes you want to check before the value disappears.
The layout is a near-copy of a real Groupon reminder, down to the “Mark as Redeemed” link and the Chicago head-office address in the footer.
The tactic: Scarcity. Something is running out. Fear of missing it overrides the instinct to check. See all six tactics.
Who gets this email
Past Groupon buyers, whose purchase history attackers can guess from breached data or simply imitate. Everyday services like oil changes, meals and spa visits are chosen because almost anyone might have bought one.
Other versions of this scam
- A “your refund is ready” message that asks you to confirm card details.
- A fake gift or bonus-voucher email offering credit if you sign in.
- A “problem with your order” notice that leads to a lookalike login page.
Check it in 30 seconds
- Look at the sender domain before the deal.
- Ask yourself whether you remember buying it.
- Open the app and look under My Groupons instead of clicking.
- Treat any countdown as a reason to slow down, not speed up.
What happens if someone clicks
The View Details button in an email like this typically leads to a lookalike sign-in page or a form asking you to confirm your payment method. Voucher and deal accounts often store a saved card, and people reuse the same password for them and for work, so a stolen deals login can be worth more than it looks.
How to report a Groupon phishing email
- At work, use your email’s Report Phishing button, or forward the message to your IT or security team, before anything else. They can pull the same email from everyone else’s inbox.
- Groupon does not publish a phishing-report address. Its customer support offers 24/7 chat, and its own scam-awareness guidance points people to the FTC. Groupon customer support
- Forward the email to the Anti-Phishing Working Group at reportphishing@apwg.org. APWG reporting
- If you lost money or shared personal details, report it to the FTC. ReportFraud.ftc.gov
Already clicked? Close the page, change the password for any account you entered, sign out of active sessions, and report it anyway. Speed matters far more than blame.
Questions about Groupon phishing emails
This template itself says the voucher stays redeemable for the purchase price after it expires, which undercuts its own urgency. Check your voucher’s terms in the app rather than trusting a countdown in an email.
Open the Groupon app or type groupon.com yourself and look at My Groupons. If the voucher exists, you will see it there with its real expiry date.
Because loss aversion is powerful. People act faster to avoid losing something they already paid for than to gain something new.
It is a phishing simulation template from Hook Security’s library, modelled on real attacks. Links and tracking have been removed from the screenshot.
Give your team a safe first encounter with emails like this.
Hook sends realistic simulations built from real attacks, then a short training moment right after any click. It runs on Autopilot.