URGENT: Your Costco Rewards — $500 Member Bonus Expires Today Promotions
Dear valued Costco member,
Our security team has flagged urgent activity on your account. You must verify your membership within the next 24 hours to claim your $500 annual reward before it is forfeited.
[SIGNAL] image-wrapping anchor — href points tosecure-costco-rewards.xyz, a suspicious TLD
brand-mismatch.
To claim your reward, please visit your member portal below:
[SIGNAL] text/href mismatch — visible text sayswww.costco.com/rewards, href goes to
secure-costco-rewards.xyz/claim.
[SIGNAL] button-wrapping anchor — link contains a
<button> CTA.
[SIGNAL] redirect-chain trap — benign-looking short URL;
Uses a suspicious TLD (.click).
Confirm your shipping address via our partner tracking portal: costco-rewards.click/u/eJwNy0E...
[SIGNAL] brand impersonation — anchor text says "Costco Member Services", href is on lookalikec0stco.com.
Questions? Contact Costco Member Services for immediate assistance.
[SIGNAL] scam phone number — toll-free number in body surrounded by keywords "urgent", "verify", "security team".Or call our security team immediately to verify your membership at 1-800-555-0199. This is an urgent matter and must be resolved today.
[SIGNAL] remote-access link — "tech support" button pointing atteamviewer.com.
If you need assistance, our support team can connect to your computer through our tech support portal: Start Remote Support Session
[SIGNAL] dangerous download — anchor href ends in.exe.
Download your reward voucher (.exe)
Thank you for being a loyal Costco member. We look forward to continuing to serve you.
Sincerely,
The Costco Member Services Team
Negative controls — these should NOT be flagged
Real costco.com rewards page — legitimate href on the same brand as the page.
Wikipedia: Costco — plain informational link.
GitHub homepage — common safe anchor.
Plain text mention of google.com as an unrelated search engine — no brand conflict, no suspicious tokens.
help@costco.com — mailto: should be ignored entirely.