[{"id":27867,"date":"2026-05-13T09:38:11","date_gmt":"2026-05-13T09:38:11","guid":{"rendered":"https:\/\/news.trendmicro.com\/?p=27867"},"modified":"2026-05-13T09:38:13","modified_gmt":"2026-05-13T09:38:13","slug":"robinhood-impersonation-scam","status":"publish","type":"post","link":"https:\/\/news.trendmicro.com\/2026\/05\/13\/robinhood-impersonation-scam\/","title":{"rendered":"The Robinhood impersonation scam that we should all pay attention to"},"content":{"rendered":"\n

This article discusses a scam that impersonated Robinhood. Neither Robinhood nor its services were involved in the scam, and this article should not be interpreted to state or imply any wrongdoing on their part.<\/em>

Robinhood patched this vulnerability on April 28, 2026. The phishing domain is now offline. If you have questions about your account security, visit robinhood.com\/support.<\/em>

Imagine this scenario: an email arrives from noreply@robinhood.com, the sender address is correct, Robinhood’s verified logo sitting beside it. The subject line reads “Your recent login to Robinhood,” and the message warns of unrecognized activity on your account.

A button says, “Review Activity Now.”

For thousands of Robinhood users in late April 2026, that button was the start of a cryptocurrency theft they couldn’t undo. This article is a post-mortem of that campaign, and while the threat described here is no longer active, the tactics it used are still out there.

Here’s what happened, and how to recognize it.<\/p>\n\n\n\n

\"Robinhood
Examples of phishing messages used in this scam. Source: TrendLife
<\/em><\/figcaption><\/figure><\/div>\n\n\n\n

What made this scam different<\/h2>\n\n\n\n

Most phishing emails have tells: a slightly wrong sender address, a suspicious domain, a misspelled logo. This campaign had none of those. Attackers found a way to abuse Robinhood’s account creation flow to let them inject fake content into emails that Robinhood’s own servers sent out.

Those emails passed every technical security check: Gmail displayed Robinhood’s verified blue checkmark and the messages landed in primary inboxes, not spam. There was nothing technically wrong with them, because technically, Robinhood sent them.

Our researchers found evidence of injected content replacing the normal email body with a fake security alert, complete with a case number and a “Review Activity Now” button. Clicking it redirected to a fake site which asked users to verify their identity, share their crypto wallet balance, and ultimately transfer cryptocurrency into a wallet controlled by the attackers, and those transfers could not be undone.

Robinhood identified and patched the vulnerability on April 28, 2026. No accounts were breached on their end, but anyone who transferred crypto through that site lost those funds permanently.<\/p>\n\n\n\n

The broader campaign: texts, spoofed emails, and phone calls<\/h2>\n\n\n\n

The April phishing emails were the most technically sophisticated piece, but they weren’t the full picture. A separate group had been running a parallel campaign since at least February 2026, sending:<\/p>\n\n\n\n