From: Bella Klein
Sent: Thursday, June 8, 2017 12:49 PM
To: Karyna Shuliak
Subject: Fwd: Fraud Protection Alert

Karyna,
Please verify charge below

Thank you,

Bella<=div>

Begin forwarded message:

| Field | Extracted text |
|---|---|
| From | "American Express" [redacted email] |
| Date | June 8, 2017 at 1:32:16 AM EDT |
| To | [redacted] |
| Subject (raw) | Subje=t: Fraud Protection Alert |
| Reply-To | "" [redacted] |

=/td>

Account Ending:

=/tbody>

<http://www208.americanexpress.com/axp/cardart/2008/12=812_AMEX_service_shdw1.jpg>
<http://www208.ame=icanexpress.com/axp/cardart/2008/AMEX_alert.jpg>

Attempt Date:

06/07/17

Merchant:<=p>

PAYPAL P=EPERS

Amount:

Status:

<=d width="2%" style="background-color:#ADAFAP;border-bottom-color:white;=order-bottom-style:solid;border-bottom-width:2pt;" rowspan="1" colspan==1">

Not=Approved
&nb=p;
Do you recognize this attempt?=/b>

h <https://cits-tracking-

prod.=mericanexpress.com/clicktrk/Tracking?mid=HEICN030201706072232144929045840=amp;msrc=ENG-ALERTS&url=https%3A%2F%2Fonline.americanexpress.com%2Fm=ca%2Fcvp%2Faction%3Fg%3D349992331290054%26x%3D005023418044878%26o%3De%26r%3=1%26c%3DHEICN030201706072232144929045840><http://www208.america=express.com/axp/buttons/glyph-checkmark.png>

Y e <https://cits-tracking-prod.americanexpress.com/clickt=k/Tracking?mid=HEICN030201706072232144929045840&msrc=ENG-ALERTS&=url=https%3A%2F%2Fonline.americanexpress.com%2Fmyca%2Fcvp%2Faction%3Fg%3D=49992331290054%26x%3D005023418044878%26o%3De%26r%3D1%26c%3DHEICN03020170607=232144929045840> s <https://cits-tracking-prod=americanexpress.com/clicktrk/Tracking?mid=HEICN03020170607223214492904584=&msrc=ENG-ALERTS&url=https%3A%2F%2Fonline.americanexpress.com%2=myca%2Fcvp%2Faction%3Fg%3D349992331290054%26x%3D005023418044878%26o%3De%26r=3D1%26c%3DHEICN030201706072232144929045840> h

<=>:

<http://www208.americanexpress.com/axp/butto=s/bttn-cap-top-red.png>

=/td>

h

=/td>N o <https://cits-tracking-prod.ameri=anexpress.com/clicktrk/Tracking?mid=HEICN030201706072232144929045840&=src=ENG-ALERTS&url=https%3A%2F%2Fonline.americanexpress.com%2Fmyca%=Fcvp%2Faction%3Fg%3D349992331290054%26x%3D005023418044878%26o%3De%26r%3D2%2=c%3DHEICN030201706072232144929045840> h <http://www208.americanexpress.com=axp/buttons/bttn-cap-bttm-red.png>

If you or an authorized party has already addressed this concern, please disreg=rd this message.

## American Express Account Prote=tion Services

&n=sp;

Privacy Statement

Update Your Email <https://cits-tracking-pr=d.americanexpress.com/clicktrk/Tracking?mid=HEICN030201706072232144929045=40&msrc=ENG-ALERTS&url=http://www.americanexpress.com/email>

Your account information is included above to help you recognize this as a customer care e-mail from American Express. To learn more about e-mail security or report a suspicious e-mail, please visit us at amer=canexpress.com/phishing <https://cits-tracking-prod.americanexpress.co=/clicktrk/Tracking?mid=HEICN030201706072232144929045840&msrc=ENG-AL=RTS&url=https%3A%2F%2Fwww212.americanexpress.com%2Fdsmlive%2Fdsm%2Fdo=%2Fus%2Fen%2Ffraudprotect ioncenter%2Ffraudprotectioncenter_identifytheft.do=3Fvgnextoid%3Db9c75c5d66a4c110VgnVCM1000000defaad94RCRD> . We kindly ask you not to reply to this e-mail but instead contact us via Customer Care <https://cits-tracking-prod.americanexpr=ss.com/clicktrk/Tracking?mid=HEICN030201706072232144929045840&msrc==NG-ALERTS&url=https://www.americanexpress.com/contactus> .

2017 American Express. All rights reserved.

AGNEUALE0034003=img style="border-style: none; display: block;" src="https://cits-track=ng-
prod.americanexpress.com/clicktrk/Tracking?mid=HEICN030201706072232144=29045840&msrc=ENG-ALERTS"
height="1" width="1" alt="" align="=>

=/td> <=tr>
=tbody>