Fake Zendesk / Freshdesk customer support helpdesk subscription payment failed, account suspended, agents cannot respond to tickets, or ticket routing disabled phishing

Phishing emails impersonating Zendesk or Freshdesk claiming the customer support subscription payment has failed, the account has been suspended, agents cannot respond to tickets, or ticket routing is disabled — directing victims to update billing through a credential-harvesting portal. A distinct attack category targeting customer support teams whose core function is handling customer inquiries: Zendesk is the world's dominant enterprise customer support platform and Freshdesk (by Freshworks) is a major SMB and mid-market customer support platform. Key facts: (1) Zendesk serves 100,000+ customers in 160 countries (at $55-$115/agent/month Suite Team-Professional, $169+/agent/month Enterprise) including 40% of the Fortune 500 as the primary customer support, sales, and engagement platform — a 'Zendesk account suspended due to billing failure' email creates an immediate customer-facing emergency: agents cannot access any support tickets, customers receive no responses, and the SLA clock continues ticking; for organizations with contractual SLA commitments, a support platform suspension creates potential breach-of-contract exposure; (2) Zendesk's position as the hub for all customer communications means suspension affects multiple teams simultaneously: customer support agents (cannot respond to tickets), sales teams (lose Zendesk Sell CRM access), IT help desk (lose internal ticket routing), and management (lose analytics dashboards showing support volume and CSAT scores); (3) Freshdesk serves 50,000+ companies (at $15-$79/agent/month Growth-Enterprise) with a particularly strong presence in mid-market technology companies and e-commerce businesses — Freshdesk's 'helpdesk suspended' hook is credible because Freshworks actively manages subscription tiers and sends payment reminders; (4) The customer support suspension hook creates second-order urgency beyond the immediate team: customers filing support tickets are often already frustrated; a support platform outage means frustrated customers escalate to social media, creating public brand damage that cannot be contained until the platform is restored; (5) Zendesk and Freshdesk credentials expose the complete customer relationship history: every support ticket including customer complaints and product defect reports, all customer PII (email, phone, account details), all internal agent notes and escalation records, all macro templates revealing the company's standard responses to sensitive issues, API keys for integrations with Salesforce, Slack, Jira, and billing systems, and all Zendesk Talk call recordings if the voice add-on is enabled. Warning signs: sender not zendesk.com or freshdesk.com or freshworks.com; genuine Zendesk billing at support.zendesk.com/hc/requests; Freshdesk billing at freshdesk.com/admin/billing.