Is the "your storage is full" email a scam?

What are the signs of a fake warning?

• The sender's address is not from apple.com or google.com, or uses a lookalike domain.
• It threatens to delete your photos within hours unless you pay now.
• It offers an unusually cheap or free upgrade, or a loyalty reward.
• Links point to an unfamiliar website when you hover or long-press them.
• It asks for card details, a password or a code sent to your phone.

The FTC's phishing advice lists urgency and requests for payment details as classic warning signs. Real storage notices from Apple and Google do not threaten instant deletion; Google, for example, gives months of notice before removing content from an account that stays over its limit.

Scammers copy logos and layouts well, so design is not a reliable test. The sender address, the link destination and the request itself tell you more than how polished the message looks.

Where do I check my real storage?

Type the address or open the setting yourself rather than following a link. If the account is genuinely full, see what happens when Google storage is full or, for Apple, iCloud full and not receiving email.

If the setting shows space to spare, delete the email and mark it as phishing so the mail provider learns from it. If it shows the account really is full, you can still ignore the email and fix the problem directly from settings; nothing in a genuine notice requires clicking its link.

Paying for storage is also something you can do safely from settings. Upgrades bought there go through Google Play or Apple, so no card number ever needs typing into a web page.

What if I already clicked or paid?

1. Change the password of the account you entered, and turn on two-step verification.
2. Call your card issuer to block the card and dispute the charge.
3. Report the message: in Gmail use Report phishing; Apple accepts reports at reportphishing@apple.com.
4. Watch the account for sign-in alerts over the next weeks.

Google and Apple both advise against sharing a password or verification code in response to any message. Treat a request for either as a sign of fraud, whatever the logo says.