Suspicious Account Activity Email to a Customer: 8 Templates

A suspicious account activity email to a customer has an unusual job. It has to make someone act on a warning about their account, using a channel that attackers copy every day. If it looks like phishing, the customer ignores it or, worse, clicks it.

Below are eight copy-paste alerts, from a routine new-device sign-in to a confirmed compromise. Each uses the same four slots: [EVENT], [TIME AND IP GEO], [ACTION TAKEN] and [WHAT TO DO NOW]. Before the templates, the short list of choices that decide whether an alert is trusted.

When should you send a suspicious activity alert?#

Send one when the account did something the owner could not have predicted and might not have done. The test is simple: if the customer would want to know within the hour, alert them. If it is a routine action they took themselves a minute ago, a confirmation is enough.

Over-alerting has a cost. A customer who gets a warning at every hotel sign-in learns to delete them, then misses the one that matters.

• A sign-in from a device, browser or country the account has not used before.
• Two sign-ins from places too far apart for one person to travel between in the time.
• A bulk export or download of data that does not match the account's normal use.
• A change to payment method, email address, phone number or password recovery options.
• A mail forwarding rule or API key created without a matching request.
• A burst of failed sign-ins, or a sign-in right after a password reset.
• Any confirmed case where you know someone other than the owner got in.

What does a good suspicious activity email contain?#

Every alert should answer four questions in order: what happened, when and where, what you did about it, and what the customer needs to do. If the customer has to read twice to find the instruction, the template has failed.

The four slots map onto those questions directly. Fill them with specifics. A timestamp with a time zone, a city-level location and a device or browser name give the customer something to recognise. Vague wording like "unusual activity" gives them nothing to check.

Should a security alert contain links?#

Our recommendation: no clickable link to sign in or change a password. Phishing emails use exactly that pattern, and customers have been told for years to be suspicious of it. An alert that asks for a click inside the email puts the customer in the position of guessing whether it is real.

The safer pattern is a verified path. Tell the customer to open your app or type your address into their browser, then go to a named menu. If you must include something, point to a page on your own domain that is also reachable from inside the signed-in product, so the customer can confirm it independently.

• Name the menu path in words: Settings, then Security, then Recent activity.
• Never include a button that signs in, resets a password or approves a device.
• Do not use link shorteners or tracking redirects on a security message.
• Send from the same domain and address as your other account mail, with SPF, DKIM and DMARC aligned, so it does not look spoofed.

The templates#

Replace anything in square brackets. Keep the line about what you will never ask for in every alert. It helps customers tell your message from a fake.

Template 1: New device sign-in#

Use this for the lowest-risk alert. The tone is informational, and the main job is to let the real owner dismiss it quickly.

Template 2: Impossible-travel login#

Use this when two sign-ins are too far apart to be one person. IP geolocation is approximate, so say that. VPNs and mobile carriers regularly put a real user in the wrong country.

Template 3: Multiple failed sign-in attempts#

Use this when someone is guessing at the account. The account may be fine, so say that plainly instead of alarming the customer.

Template 4: Bulk export detected#

Use this when an account downloads far more than usual. Be careful with wording: the customer or their team may have started the export on purpose, so describe the event without accusing anyone.

Template 5: Payment method changed#

Fraud often starts with a swapped card or bank account. This alert goes to the old contact address, not just the new one, because the person who made the change may control the new address.

Template 6: Email, phone or password changed#

Recovery details are what attackers change to keep control. Send this to the previous email address and phone number, with a window in which the customer can reverse the change.

Template 7: Forwarding rule or API key created#

A hidden forwarding rule or new API key is a quiet way to keep reading an account after the password is changed. Tell the customer what was created and how to remove it.

Template 8: Confirmed compromise and lockdown#

Use this one only when you know someone else had access. The tone shifts: be direct, say what you know and do not know, and give the customer a human to speak to. Do not guess at impact. Say what was accessed only once you have confirmed it.

If personal data was exposed, this is a notification matter with legal requirements that differ by region. This template is the customer-facing account alert, not a legal breach notice. Check the deadlines that apply to you with counsel.

Which template fits which event?#

Use this table to choose quickly and to set the right tone. Match the severity of the wording to what you actually know.

How do you write an alert that does not look like phishing?#

This is the hard version of the situation. The customer is being asked to trust an unsolicited email that warns of danger. That is the exact shape of a phishing message, so every choice in your template should lower that suspicion.

Urgency is the biggest trap. Phrases like "act now", "within 24 hours" and "your account will be closed" are standard phishing language, and they train customers to click without thinking. State the risk plainly and let the facts carry the weight. When there is a real deadline, give it once with a reason.

• No clickable sign-in or reset links. Give a named path inside the app or tell them to type your address.
• No attachments, ever.
• No request for a password, full card number, verification code or personal details, and a sentence saying so.
• Address the customer by name, but do not rely on that alone, since attackers have names too.
• Include a detail only a real service would know, such as the device, browser or approximate time.
• Provide a reply path that goes to a monitored mailbox and a phone number listed on your website, not only in the email.

What should you tell a customer whose account was accessed?#

Tell them what you know, what you do not know, what you have done and what they should do. Stick to facts you have confirmed. Guessing at scope in either direction damages trust, and a correction later costs more than a plain statement of uncertainty now.

Give a time for the next update and keep it. If their data may have been exposed, point them to your fuller disclosure rather than loading this message with legal detail.

What if the customer does not reply?#

Most alerts do not need a reply, and silence on a low-risk alert usually means the customer recognised it. For higher-risk events, the account's state does the protecting while you wait: sessions revoked, exports paused, payment changes held.

For templates 5 to 8, plan a second touch. Wait a sensible interval, then send a short follow-up that restates the event and the path inside the app. Use another channel too, such as an in-app banner shown at the next sign-in or an SMS that says only to check the app, with no link.

1. 1

   Hold the protective state

   Keep the account's restrictions in place until the customer confirms or you verify them another way. Do not roll back a lockdown just because a day has passed.

2. 2

   Send a short follow-up

   Restate the one event in two sentences, repeat the in-app path, and include the reply address. Do not escalate the wording or add urgency.

3. 3

   Add a second channel

   Show an in-app notice at the next sign-in. If you use SMS, say only that there is a security notice in the app and include no link.

4. 4

   Try a human contact

   For high-value accounts or a confirmed compromise, call the number on file. Verify by calling out, never by trusting an inbound caller.

Where does AI Emaily fit?#

We build AI Emaily, so weigh this accordingly. It does not send security alerts from your product. For that you need your own application or a transactional email service, and AI Emaily is neither.

What it does cover is the inbox side. Customers reply to these alerts, and those replies are time-sensitive and easy to bury. AI Emaily triages the inbox, flags phishing-style messages through its spam and phishing defence, and drafts replies from the context you set. In approval-first mode, nothing goes out until you review it, which matters when the reply concerns a possible compromise. The 7-day free trial needs a card, and you pay nothing if you cancel before day 7.