PDA

View Full Version : Scam Alert


Paleo Pete
08-13-2004, 01:15 AM
I'm sure many of you aware of this, but I thought a notification might be a good idea anyway, might save one or three of our viewers.

I've received email scams from US Bank and CitiBank in the past couple of days, wanting me to click a link to "confirm your data"...I don't have an account with either, so I have no data to confirm, and I don't think either bank would expect customers to do this by email to begin with.

The one from US Bank was quite obvious, "As the Technical service of bank have been updating..." Both are gif files, can't copy & paste the text, it's a picture.

Both also have nonsense text in the headers, I'm not sure if it shows up in Windows or not, I'm looking at a Linux box. Filenames are conjugacy.GIF [Citibank scam] and bhutan.GIF

If you receive an email of this nature, DO NOT, I strongly repeat [u]DO NOT click that link.

I'll try to attach a picture of one of them, both are quite similar. These scams are getting more common, if you receive one, contact the bank about it and don't even think about giving any website your personal information. If the bank needs it, they will most likely contact you by mail or phone, and have you come to their local branch in person to deal with it.

I've also forwarded copies of both of these scam emails to uce@ftc.gov which is the spam email address set up by the Federal Trade Commission.

Urban Legends (http://urbanlegends.about.com/library/bl_us_bank_scam.htm) has a good article about an earlier version of this scam. The one copied in that article was a text based, possibly html. This one is a gif picture file that looks exactly like a legitimate email from the bank it is supposed to be from. The only way to tell it's a scam is by knowing that these banks WILL NOT ask you to submit personal information by email, then by looking it up.

Again, if in doubt, CALL YOUR BANK.

From the US Bank website Security Standards (https://www4.usbank.com/internetBanking/en_us/info/BrowserRequirementsOut.jsp)

On the other hand, for security reasons, Passwords are encrypted and are known only to the user. No one at U.S. Bank will ever need to know your Password, and you should never furnish it to anyone who claims to represent U.S. Bank.

This from their Privacy Pledge (http://usbank.com/privacy_pledge.html)

We will never initiate a request for sensitive information from you via email (ie., Social Security Number, Personal ID, Password, PIN or account number). If you receive an email that requests this type of sensitive information, you should be suspicious of it. We strongly suggest that you do not share your Personal ID, Password, PIN or account number with anyone, under any circumstances.

Just knowing those two quotes might save you a lot of trouble...they also have a fraud email link, look it up and forward scam emails to them. It's in the links above. Citibank probably has one too, I haven't looked, but I'm sure they view this issue the same as US Bank.

PrntRhd
08-13-2004, 01:48 AM
These phishing scams are really going to be a problem until authentication schemes catch up. They use graphics that look very real but they have nothing to do at all with real bank sites.
NEVER respond to an e-mail like that, good advice Pete.
:)

deddard
08-13-2004, 04:59 AM
Had the same email myself.
I was wondering who to notify - I guess the FTC one would be the place.

I've kept the email - I'm going to use it as an example when I start teaching users about basic security. I've also got a paypal one (very convincing) - I used to just bin them, which I'm regretting now, as they could prove useful as teaching aids (I can remember getting several of the 'I need to ship some diamonds out of Sierra Leone mails:D )

pave_spectre
08-13-2004, 05:49 AM
Funnily enough I was just checking my email while reading this thread and discovered the very email. The attachment mine came with was luminous.GIF, and the header definitely contained junk.
Don't know how they got my email since I'm extremely careful about who I give this one out to. Oh well. :rolleyes:

jlreich
08-13-2004, 08:22 AM
Had the US Bank one a few days ago, contacted the bank immediately and forwarded it to their fraud unit.

I looked in properties and the address was some strange name. Very odd.

John0904
08-13-2004, 12:58 PM
Thanks for the heads up, Pete.

I notified family and friends of the scam. They are not very computer savvy and might become a statistic. :(

Sad thing is that probably 1 in 10 people will actually click the link. (Guessamation)

Know where the link went to? Looks like the picture has a believable link, but that the real link is a href to another site.

Mark Miller
08-13-2004, 01:08 PM
Thanks Pete,
I actually use Citibank and had this happen to me awhile ago.
I did not respond, mainly because citi is so lame they never would do anything like that;) Notified them and they told me of the scam.
Good advice.
Mark

Paul Komski
08-13-2004, 04:33 PM
Just not sure about one thing - how would clicking on the link be a scam. It could activate/confirm your presence to a spammer or let in any sort of muck if your security is poor but, of itself, how is it a scam since no personal data will have been sent. The url that the link leads to would be the clue. Garbage in the headers, as with garbage/nonsense words in spam mail, is usually just an attempt to avoid various spam filters by "confusing them" and by "diluting" the spam content to a smaller percentage of the whole.

If a form next popped up with personal data on it requesting confirmation or with boxes for you to complete - then that would look scammish rather than spammish.

When I think of the trouble you have to go to in order to get a login name, password and PIN for on-line banking or tax returns - it amazes me that people would post off data about themselves in this fashion - but then people actually get sucked into those Nigerian scams - so perhaps its not that surprising after all.

PrntRhd
08-13-2004, 10:16 PM
Paul,
Some of these sites ask for personal information they will use to steal one's identity, some of them just download a trojan/keylogger so they can steal your passwords and take the money later.

pop pop
08-15-2004, 01:57 AM
The US Bank scam has been going on for at least a year. The company I work for (180,000 employees) uses that bank for its corporate cards, among other things. It's amazing the phishers haven't been caught.

Donn
08-16-2004, 12:42 PM
[i] but then people actually get sucked into those Nigerian scams - so perhaps its not that surprising after all. [/B]


The Folklore Discussion List out of Texas A&M has people on it that collect and study these things, especially the Nigerian...cultural of crime by language.

Pete, if there is a way to forward that to me as a private message so that I can forward it to the Folklore List, I will do so.

:cool:

Paleo Pete
08-17-2004, 01:11 AM
Pete, if there is a way to forward that to me as a private message...

Forward what? The picture? The whole post? The email itself?

If you want the email I can do that, let me know. The picture or post, just copy & paste. Save the picture as...etc.

PrntRhd
08-20-2004, 10:58 AM
Just an update, some websites have posted phishing tools as "kits" so amateurs can do it too.
:mad:

zdnet (http://zdnet.com.com/2100-1105_2-5317087.html)