RETAIL BRAND IMPERSONATION

"Bath & Body Works" scam email: someone tried to log in, is it real?

An email lands claiming an unrecognized device just signed into your Bath & Body Works account, with a friendly "Secure my account" button. It looks like a routine security notice. It is a credential-phishing lure, and here is exactly how to tell.

SB

SafeBrowz Threat Research Security ResearchJuly 13, 20269 min read

What the fake login-attempt email looks like

The email arrives dressed in real Bath & Body Works branding: the script wordmark, the white-and-blue palette, a tidy header bar, and often a small map graphic or a device name to make the "unrecognized login" feel concrete. The subject line is one of a handful of interchangeable shapes:

• "Unusual sign-in attempt on your Bath & Body Works account"
• "We noticed a login from a new device"
• "Action required: verify your account to keep it active"
• "Someone tried to access your account. Was this you?"

The body says a device you do not recognize, often pinned to a random city, just tried to sign in, and that access has been paused "for your protection." Then comes the single call to action: a button reading "Secure my account," "Verify account," "Was this me?" or "Review activity." That button is the entire scam. The story around it exists only to get your thumb onto it before you think.

Real Bath & Body Works security messaging behaves differently. If there is genuinely something to review, you see it after you sign in at bathandbodyworks.com yourself. A legitimate retailer will never make the only way to "secure" your account a button embedded in an unsolicited email. This is the same login-alert template that gets aimed at bigger brands too, and the tells are identical across all of them, as we break down in our Amazon account verification email scam guide.

Where the "Verify account" button actually sends you

Tap the button and you land on a page that looks like the Bath & Body Works sign-in screen: the same logo, the same email-and-password fields, the same rounded buttons. Everything is copied except the one thing that matters, which is the web address in the bar. The domain is never the real one. Illustrative examples of the lookalike domains this lure uses include bathbodyworks-verify[.]com, bath-bodyworks-secure[.]com, bbw-account-login[.]net, and bathandbodyworks[.]account-review[.]shop. On a phone, where the address bar is short and the branding fills the screen, that difference is easy to miss.

You type your email and password to "confirm it was not you." The moment you submit, that pair of credentials is delivered straight to the attacker. There is no security check happening. The page exists for one purpose, which is to harvest what you type. Because so many people reuse the same email-and-password combination across shopping sites, a stolen Bath & Body Works login is often quietly tested against email accounts, other retailers, and payment services within minutes. If you want a deeper walkthrough of how these cloned sign-in screens are built to fool you, our guide on the fake login popup on a trusted site shows the mechanics.

The "confirm your payment method" second step

Many versions of this scam do not stop at your password. After the fake login "succeeds," the page shows a second screen: "To finish securing your account, please confirm your payment method." It asks for your full card number, expiry, CVV, and sometimes your billing address and date of birth. This is the real prize. Login credentials are useful, but a full card record with the security code is directly cashable.

No genuine account-security flow asks you to re-enter your full card details to prove your identity. A real retailer already has your saved card on file and would never need the CVV again to "verify" you. The instant a page that arrived from an email asks for card and CVV together, you are looking at a harvesting form. This card-capture step is exactly what ties the lure to the wider world of fake online store scams, where the whole storefront is built to skim payment details.

Why the From address is not proof of anything

The most common reason people trust these emails is that the sender appears to be from Bath & Body Works. Here is the uncomfortable truth: the visible From address can be forged. Email was designed decades ago without built-in sender verification, so an address in the From line is a label the sender chooses, not an identity the system checks. Modern anti-spoofing standards like SPF, DKIM, and DMARC help, but plenty of phishing still slips through, and most people never inspect message headers on a phone anyway.

So two things are true at once. First, a From address showing bathandbodyworks.com is not proof the email is real, because that address can be spoofed. Second, a lookalike sender such as one on bathandbodyworks-support[.]com or bbw-rewards[.]shop is outright fake and needs no further debate. Either way, the sender line settles nothing. The only thing that settles it is opening the site yourself. If you are ever unsure whether a page is genuine, our checklist on how to tell if a website is a scam walks through the signals that actually matter.

How to check if the login-attempt email is real

The rule is the same for every account-alert email, from any brand. Treat the message as a prompt to go and check for yourself, never as a place to act. Confirm the claim through a channel you opened.

1. Do not tap the button. Not even to "see if it is real." The lookalike page starts working the instant it loads.
2. Type bathandbodyworks.com into your browser yourself, or open the official app. Do not use the email's link, and do not search for the login page during a scare, because paid ads can occasionally push lookalike sites to the top.
3. Sign in normally and look for a real security notice. If your account genuinely flagged a strange login, you will see it inside your account settings or activity. If there is nothing there, the email was fake.
4. Check your recent orders and saved payment methods. A real intrusion would leave traces. A phantom "login attempt" from an email usually leaves none.
5. If anything looks genuinely wrong, contact Bath & Body Works through the phone number or help page on the official site, never a number or link printed inside the suspicious email.

Red flags in a fake Bath & Body Works security email

• A button is the only way to "fix" it. Verify, Secure, Confirm, Review. Real security prompts want you to sign in on the site, not click through from a mail.
• Urgency and a deadline. "Access paused," "verify within 24 hours," "or your account will be closed." Pressure is the mechanism, not a real policy.
• The link domain is not bathandbodyworks.com. Long-press the button on mobile or hover on desktop and read the domain immediately before the first single slash. Only an exact match on the real domain is genuine.
• It asks for your card and CVV to "verify." No account-recovery step needs your full card and security code. That is a payment-harvest form.
• Generic greeting. "Dear Customer" or "Dear Valued Member" points to a bulk send against a leaked email list, not a message tied to your real account.
• Small language and layout slips. Odd spacing, a slightly wrong logo, a shortened or scrambled sender name. Any one of these on an "account security" email is enough to stop.

How SafeBrowz blocks this threat

SafeBrowz runs a 3-layer detection architecture: Local + APIs + AI. On this specific lure, the layers stack up like this.

• Layer 1, local detection: 60+ URL patterns plus 550+ brand signatures, including Bath & Body Works, run inside the extension before the page renders. The brand-plus-keyword lookalike shapes (bathbodyworks-verify, bbw-account-login, and the brand-on-a-not-real-domain patterns) match instantly against the local brand database, with no page data leaving your device.
• Layer 2, API checks: the destination is cross-referenced against Google Safe Browsing, PhishTank, URLhaus, and scam-TLD intelligence. Fresh retail phishing domains are frequently reported to these feeds within hours of a campaign going live.
• Layer 3, AI deep scan (Premium): content analysis in 100+ languages recognizes a Bath & Body Works sign-in page, or a "confirm your payment method" form, served from any domain other than the real one, and flags it before you ever type into it.

Detection signatures come from threat-intelligence research and brand-database analysis, not from user browsing data. Per-user URL history is never stored.

If you already entered your password or card

Do not panic, but do move quickly. Speed is what limits the damage.

1. Change your Bath & Body Works password now, by typing bathandbodyworks.com yourself and signing in. Use a long, unique password.
2. Change that password anywhere else you reused it, starting with your email account. Reused passwords are the whole reason a single leak spreads.
3. If you entered card details, call your bank or card issuer using the number on the back of the card. Ask them to watch for or block fraudulent charges, and consider a replacement card. Report the card as compromised even if nothing has been charged yet.
4. Turn on two-factor authentication wherever it is offered, especially on your email, which is the master key to your other accounts.
5. Watch your statements and account activity for the next few billing cycles. Small "test" charges often precede a larger one.

How and where to report it

Reporting takes a few minutes and helps get the lookalike page taken down faster.

1. Report the impostor to the FTC at reportfraud.ftc.gov. The FTC tracks brand-impersonation and imposter scams and uses these reports to build cases.
2. File with the FBI Internet Crime Complaint Center at ic3.gov if you lost money or handed over card or personal details.
3. Mark the email as phishing in your mail app and delete it. That trains your provider's filters and removes the temptation to click it again later.
4. Tell Bath & Body Works through the official site's help or contact page, so their team can pursue takedown of the fake domain.

Install SafeBrowz free

Add the browser extension, or the SafeBrowz Android app, that runs every check in this article automatically, on every page, before it renders. Free forever.

Add to Chrome Add to Firefox Add to Edge Get it on Google Play

Upgrade to Premium for AI deep scan of novel retail login clones in 100+ languages.

Frequently asked questions

Is the "someone tried to log into your Bath & Body Works account" email real?

No, treat it as phishing. Bath & Body Works handles account security inside its own site and app, not through a button you click from an unsolicited email. If there were a genuine login concern, you would see it after signing in yourself at bathandbodyworks.com. If nothing appears there, the email was fake.

What is the real Bath & Body Works website?

The official domain is bathandbodyworks.com. Type it into your browser yourself, or use the official app, rather than following a link from an email or text. Any variation such as bathbodyworks-verify or bbw-account-login is a lookalike built to harvest your login.

The email came from bathandbodyworks.com. Doesn't that mean it is real?

No. The visible From address can be spoofed, because email was not designed to verify who the sender really is. A From line showing the real domain is not proof, and a lookalike sender is obviously fake, so the sender never settles it. The only reliable check is to open the site yourself and sign in.

I clicked the link and entered my email and password. What should I do?

Change your Bath & Body Works password immediately by typing bathandbodyworks.com yourself and signing in, then change that password anywhere else you reused it, starting with your email. Turn on two-factor authentication where offered. Assume the old password is compromised and retire it everywhere.

I entered my card details on the "confirm payment" step. What now?

Call your bank or card issuer using the number on the back of the card, tell them the details were entered on a phishing page, and ask them to monitor for or block fraudulent charges and issue a replacement card. Do this even if no charge has appeared yet, since scammers often test with a small amount first.

Where do I report a Bath & Body Works phishing email?

Report the imposter to the FTC at reportfraud.ftc.gov, and file with the FBI Internet Crime Complaint Center at ic3.gov if you lost money or shared personal details. Also mark the email as phishing in your mail app and notify Bath & Body Works through its official contact page.

Bottom line: A "someone tried to log in to your Bath & Body Works account" email with a verify-account button is a credential-phishing lure, not a security notice. The From address proves nothing, the branding is copied, and the button leads to a fake sign-in page and often a card-harvest form. The defense is simple and never changes. Do not click the email. Type bathandbodyworks.com yourself and sign in to check. Never enter your password or card from an email link. And add a browser-layer scanner like SafeBrowz so the fake page is flagged before it ever loads.