Have you received an email claiming that your Roundcube mailbox is almost full and that you need to upgrade your storage, verify your account, or log in to prevent your mailbox from being suspended?
Be careful before clicking anything.
Messages using mailbox-storage warnings can be used as phishing emails designed to trick recipients into revealing their email addresses, passwords, or other account information. Roundcube itself has previously warned users about phishing messages impersonating Roundcube Webmail and directing recipients to fake login pages.
This guide explains how the “Roundcube Mailbox Is Almost Full” email scam works, the warning signs to look for, what to do if you clicked the link, and how to protect your email account.
What Is the Roundcube Mailbox Is Almost Full Email Scam?
The scam uses a fake or misleading mailbox-storage notification to encourage you to take immediate action.
The message may claim that:
- Your mailbox is almost full.
- Your account has exceeded its storage limit.
- You will stop receiving new emails.
- Your account needs to be upgraded.
- You need to verify your email account.
- Your mailbox will be suspended if you do not respond.
- You must click a button to increase your storage.
The email may contain a button such as “Increase Storage,” “Verify Account,” “Manage Mailbox,” “Continue,” or “Login.”
The link may lead to a fraudulent website that imitates a webmail login page.
If you enter your credentials there, scammers may be able to capture the information.
Important: Roundcube Is Not Your Email Provider
One of the most important details to understand is that Roundcube is not an email service like Gmail or Outlook.com.
Roundcube is open-source webmail software that email hosting providers can install on their servers. Roundcube specifically states that users do not have an email account with Roundcube itself.
This distinction is important when you receive an email supposedly from “Roundcube Webmail.”
Roundcube has warned that phishing emails have impersonated its name and attempted to convince users to enter their email passwords on fraudulent websites. It also states that it does not send messages asking users to enter their email password.
Therefore, if you receive a storage notification, verify it with the company that actually provides your email account or hosting service.
How the Phishing Scam Works
The scam generally follows a simple process.
1. You Receive a Storage Warning
The message claims that your mailbox is approaching its storage limit.
The scammers may use technical-looking language or a storage percentage to make the message appear legitimate.
2. The Email Creates a Sense of Urgency
You may be told that failing to act could result in:
- Missed emails
- Account restrictions
- Mailbox suspension
- Loss of access
- Delivery problems
Urgency is one of the common techniques used in phishing messages. CISA advises consumers to be cautious about unexpected messages that create pressure to act immediately.
3. You Are Given a Login Button
The email provides a link supposedly allowing you to resolve the storage problem.
However, the destination may not belong to your email provider.
4. A Fake Webmail Page Appears
The fraudulent website may copy the appearance of Roundcube or another familiar webmail service.
It may contain:
- A Roundcube logo
- Email and password fields
- Familiar colors
- A mailbox-storage message
- A “secure login” notice
The appearance of a website is not proof that it is legitimate.
5. Your Credentials May Be Captured
When you submit your email address and password, the information could be transmitted to the person operating the fraudulent website.
This is the primary danger associated with credential-phishing scams.
How to Recognize the Roundcube Mailbox Scam
Check the Sender’s Address
Look carefully at the actual sender address rather than relying only on the displayed sender name.
A scammer can use a display name such as Roundcube Webmail even when the underlying email address belongs to an unrelated domain.
Examine the Link
Before clicking a link, hover your mouse over it and inspect the destination.
If the address does not correspond to your legitimate email provider or organization, do not open it.
CISA recommends being cautious with suspicious hyperlinks and messages that request personal information.
Watch for Urgent Language
Be cautious when an unexpected message says you must act immediately to avoid losing access.
Scammers commonly use urgency to discourage people from verifying the information independently.
Look for Unusual Grammar
Spelling errors, strange wording, inconsistent capitalization and awkward sentences can be warning signs.
However, don’t rely on grammar alone. Some phishing emails are professionally written.
Be Suspicious of Password Requests
An unexpected email asking you to enter your email password should receive extra scrutiny.
Roundcube has specifically warned users about phishing emails that impersonate Roundcube and attempt to obtain email passwords.
Is the Mailbox Actually Full?
It is possible for an email account to have a genuine storage limit.
However, do not verify a storage warning by clicking the link in the suspicious email.
Instead, open your normal webmail page manually or visit the official website of your email hosting provider.
You can also contact your hosting provider or IT administrator using contact information you already know to be legitimate.
Roundcube explains that it does not manage individual users’ email accounts, reset their passwords, or add and remove accounts. Those matters should generally be handled by the internet service provider, email host, or organization responsible for the account.
What to Do If You Received the Email
If you haven’t clicked the link, the safest approach is straightforward:
- Do not click any links.
- Do not download attachments.
- Do not reply to the sender.
- Verify the issue directly with your email provider.
- Report the message as phishing or spam.
- Delete the suspicious email.
The FTC similarly recommends avoiding links and attachments in unexpected messages and contacting companies through websites or contact information you know to be genuine.
What If You Clicked the Link?
Simply clicking a phishing link does not necessarily mean your email account has been compromised.
If you clicked the link but did not enter your password or other sensitive information, close the website and avoid interacting with it further.
You can also update your security software and run a security scan if you are concerned about anything being downloaded to your device.
What If You Entered Your Password?
If you entered your email password on a suspicious website, act promptly.
Change Your Password
Go directly to your legitimate email provider or hosting account and change your password.
Do not use the link from the suspicious email.
Use a Unique Password
If you used the same password elsewhere, change those passwords as well.
Using unique passwords reduces the risk that one compromised password will affect multiple accounts.
Enable Multi-Factor Authentication
If your email provider supports multi-factor authentication (MFA), enable it.
MFA provides an additional verification step and can make it harder for someone to access an account using only a stolen password. CISA recommends using MFA to strengthen account security.
Check Your Account
After changing your password, review your account for unusual activity.
Pay particular attention to:
- Unexpected sent messages
- Unknown forwarding settings
- Unfamiliar filters
- Unrecognized recovery information
- Password-reset notifications
- Unfamiliar login activity
If you notice anything unusual, contact your email provider or IT administrator.
How to Report the Scam
You can report the message using your email provider’s Report Phishing or Report Spam option.
For additional information about phishing protection, the FTC provides a useful guide on how to recognize and avoid phishing scams.
In the United States, phishing emails can also be forwarded to reportphishing@apwg.org, and suspected fraud can be reported through the FTC’s ReportFraud.gov service.
Readers outside the United States should use their country’s appropriate cybercrime or consumer-protection reporting service.
Official Roundcube Resources
If you use Roundcube, these official resources are useful:
- Roundcube Official Website — Learn more about the Roundcube webmail software.
- Roundcube Phishing Alert — Roundcube’s warning about phishing messages impersonating its webmail software.
- Roundcube Contact Information — Information about what Roundcube can and cannot provide support for.
- FTC: How to Recognize and Avoid Phishing Scams — Consumer guidance on identifying phishing attempts.
- CISA Secure Our World — Security guidance covering phishing, passwords and MFA.
How to Protect Your Email Account
Good email security does not require complicated steps.
Use Strong, Unique Passwords
Avoid using the same password for your email and other websites.
A password manager can make it easier to create and maintain unique passwords.
Enable MFA
Where available, enable multi-factor authentication on your email and other important accounts.
Keep Software Updated
Keep your operating system, browser, security software and other applications updated.
Roundcube also publishes security updates for its software. For example, Roundcube released security updates for versions 1.6 and 1.7 in July 2026 addressing several reported vulnerabilities.
Be Careful With Unexpected Emails
Don’t assume an email is legitimate simply because it uses a familiar company name or logo.
Instead, verify the information independently.
Don’t Let Urgency Make the Decision
If an email says you must act immediately, pause and investigate before doing anything.
That extra moment can prevent a phishing attack.
Frequently Asked Questions
Is the “Roundcube Mailbox Is Almost Full” email legitimate?
It should be treated cautiously. Roundcube has previously warned about phishing emails impersonating Roundcube Webmail and attempting to obtain users’ email passwords.
Does Roundcube provide email accounts?
No. Roundcube is open-source webmail software used by email hosting providers. It is not an independent email service where users maintain accounts directly with Roundcube.
Can a Roundcube mailbox really become full?
The mailbox managed by your actual email provider can have a storage quota. However, you should verify the status directly through your email provider rather than relying on an unexpected email.
What should I do if I entered my password?
Change the password immediately through your legitimate email provider, change any reused passwords, enable MFA where available, and review the account for suspicious activity.
Should I click the “Increase Storage” button?
If the message was unexpected, it is safer not to click it. Open your email provider’s website independently and check your account from there.
Can phishing emails steal my email password?
Yes. Credential-phishing websites are specifically designed to trick users into submitting usernames and passwords. The FTC warns that phishing messages can be used to steal passwords and gain access to online accounts.
Final Verdict
The “Roundcube Mailbox Is Almost Full” email should be approached with caution, particularly if it asks you to click a link, verify your account, or enter your password.
Roundcube itself has warned users about phishing campaigns impersonating its webmail software. Remember that Roundcube is software used by email hosting providers, not the company that directly manages your email account.
If you receive a mailbox-storage warning, verify it independently through your legitimate email provider. Never provide your email password to a website simply because an unexpected email tells you to do so.
