Mailbox full and account suspended phishing: how to spot and stop it

"Your mailbox has exceeded its storage limit. 47 incoming messages are on hold. Verify your account to release them." Emails like this are some of the most common phishing in business inboxes, and they're effective because storage limits are real. This guide explains how these scams work, what a genuine full mailbox looks like in Microsoft 365 and Google Workspace, and how to check your storage without clicking anything.

What do mailbox full and account suspended phishing emails look like?

They come in a handful of shapes, all built around losing access to email:

The FTC's list of phishing tricks covers the same ground. Phishing emails "claim there's a problem with your account or your payment information — there isn't," or "say you need to confirm some personal or financial information — you don't" (FTC).

The link almost always goes to a fake Microsoft 365, Google, Outlook or webmail sign-in page. Many arrive as a link inside a PDF, a QR code or an HTML attachment, which makes them harder for a filter to read. See fake Microsoft login pages and HTML attachment phishing.

Why business mailboxes are the target

• One password opens a lot. In Microsoft 365 or Google Workspace, the same sign-in usually reaches files, chats and other apps, not just mail.
• A real mailbox sends convincing phishing. Attackers use stolen accounts to send fake invoices and payment changes to customers and suppliers. See business email compromise.
• Storage notices feel normal at work. People get IT messages about quotas, licenses and migrations, so one more doesn't stand out.
• Generic branding works for everyone. "Webmail admin" or "IT helpdesk" fits any company, so one campaign can be sent to thousands of domains.

What does a real full mailbox look like?

Knowing what genuine warnings do makes fakes easier to spot.

In Microsoft 365

Exchange Online has three thresholds (Microsoft Learn):

1. Warning: "The user receives an email warning that the mailbox is approaching the maximum size limit," to "encourage users to delete unwanted mail."
2. Prohibit Send: the user "can't send new messages until enough email is deleted to bring the mailbox below the size limit."
3. Prohibit Send/Receive: "Exchange Online rejects any incoming mail when the mailbox size limit is reached, and sends a non-delivery report (NDR) to the sender."

At the time of writing (October 2026), Microsoft lists 100 GB user mailboxes for Microsoft 365 Business Basic, Standard and Premium and for Enterprise E3/E5, with the warning at 98 GB and sending blocked at 99 GB. Office 365 E1 and Exchange Online Plan 1 mailboxes are 50 GB. Admins can set lower limits, so check your own.

Notice what isn't there. Exchange doesn't hold incoming mail "pending verification". When a mailbox is completely full, new mail bounces back to the sender with an error such as 552 5.2.2 mailbox full. There's nothing for the user to "release" by signing in through a link.

In Google Workspace

Google Workspace storage is shared between Gmail, Drive and Photos, and is pooled across the organization unless an admin sets per-user limits. Google's Admin Help says that when a user goes over a storage limit, their "ability to send and receive email in Gmail is impacted," and that "Education customers are exempt from this restriction" (Google). Users still fix it by deleting files or asking their admin for more storage, not by verifying their account through an email link.

The rule that follows

Genuine storage warnings tell you to delete or archive. They don't ask you to sign in, verify, upgrade or pay through a link. If a "mailbox full" email wants your password, it's phishing.

How do you check your real mailbox storage?

Teach users to check from inside the app they already use, never from the email.

For users

1. Outlook on the web: select Settings, then Account, then Storage (Microsoft Support).
2. New Outlook for Windows: select Settings, then Accounts, then Storage.
3. The storage page shows how much space each folder uses and can permanently delete items older than 3, 6 or 12 months.
4. Gmail: open your Google account's storage settings from a bookmark or by typing the address, not from the email. If you're really near the limit, delete large attachments and old files, or ask your admin.
5. If in doubt, call or message IT on a channel you already use.

For Microsoft 365 admins

In the Microsoft 365 admin center, go to Reports > Usage, select Exchange, then on the Email activity tab select View More and choose Exchange > Mailbox usage (Microsoft Learn). The Quota chart groups mailboxes into Good, Warning, Can't send and Can't send/receive, and the table shows Storage used (MB) against each quota. If a user reports a "mailbox full" email and their mailbox shows Good, you have your answer.

For Google Workspace admins

In the Google Admin console, go to Menu > Storage. The page shows overall use and a "Users using the most storage" section; select View all users to rank everyone by storage, or a user's name for details (Google).

Tell users how real notices arrive

Write down, in one place, how your organization really communicates about mail. For example: "IT never asks you to sign in from an email link. Storage warnings come from Microsoft and only ask you to delete mail. Migrations are announced in advance by [named person]." A user who knows the real process spots the fake one.

Reading a fake notice line by line

Take the example from the top of this guide: "Your mailbox has exceeded its storage limit. 47 incoming messages are on hold. Verify your account to release them."

• "Exceeded its storage limit": if that were true, Microsoft 365 would already be rejecting new mail, and you'd be hearing from people whose messages bounced.
• "Messages are on hold": neither Microsoft 365 nor Google Workspace holds mail for you to release by verifying an account. Quarantined spam is a different thing. If your organization uses a quarantine, check it from a bookmark or ask IT rather than following a link in an unexpected email.
• "Verify your account": your mail provider already knows who you are. You signed in to read the email.
• The sender: usually a free mailbox, a lookalike domain or a compromised account at another company, behind a display name like "Mail Administrator".

What should users do with a suspicious notice?

1. Don't click. Not the link, not the button, not the QR code.
2. Check the sender's real address, not just the display name. "Microsoft 365 Admin" from support@mail-quota-center.example isn't Microsoft.
3. Check storage yourself using the steps above.
4. Report it with the Report button in Outlook or Gmail. Our guide to reporting phishing emails shows where it is.
5. If you typed your password, change it from the real sign-in page and tell IT immediately. Then follow what to do after clicking a phishing link.

Points for security awareness training

• Real quota warnings say delete; fake ones say sign in.
• "Messages on hold, verify to release" doesn't match how Microsoft 365 or Google Workspace work.
• Countdown timers and "24 hours" deadlines are pressure, not policy.
• A sign-in page that opens from an attachment is always suspicious.
• Reporting quickly matters more than being sure. Others probably got the same email.

The UK's National Cyber Security Centre makes two points worth adopting. "No training package, including phishing simulations, can teach users to spot every phishing attempt," so pair training with technical controls. And "users who fear reprisals will not report mistakes promptly, if at all," so thank people who report, including those who clicked (NCSC). For a fuller program, see security awareness training for small businesses.

How do you reduce these emails at the admin level?

• Filter before the inbox. Credential phishing is a core job for any spam filter. Quarantine HTML and SVG attachments, and check links at click time where you can. See how spam filters work.
• Tag external mail. A banner on mail from outside makes "IT Helpdesk" messages from strangers stand out.
• Use phishing-resistant MFA, so a typed password alone isn't enough. Some phishing kits relay MFA codes too.
• Watch for signs of a compromised account, such as new forwarding rules or unusual sign-ins. See signs an email account is compromised.
• Keep real quotas healthy. Archiving policies and storage alerts mean genuine warnings are rare, so any warning gets a second look.

Next steps

• Send staff a two-line note: how real storage warnings look, and how to check storage in Outlook or Gmail.
• Run the Mailbox usage report or the Google storage page this week and fix any mailbox that's genuinely close to full.
• Check a suspicious notice's real sender with the Email Header Analyzer.
• iBlockSpam filters phishing at the MX level before it reaches any mailbox on your domain, with personal quarantines and digests for every user. See how it works.

Browse our other phishing and threat guides.