Tuesday, February 07, 2006
« Google Maps, on your cellular phone. | Main | 12:15 PST - Get an XBox Premium RIGHT NO... »

I didn't fall for it. But let's just say I almost clicked.

Seems like they'll never end. And they're getting more clever every day. I try and remind myself, not to fall for it. Just delete them, if it's really serious, I'll get a call from my credit card company. They just won't be contacting me online. I had renewed a domain name today, and the site I was using said that my charge did not go through. I don't carry a balance on my credit card, so I was a tad alarmed.

I promptly called my card company, and they said, "No... it went through." I thanked them and hung up. I submitted a trouble ticket with the domain registration company. Weird, but it must have gone through. I chalked it up as an error on their side.

Later, I went to check my email account, to see if they had responded. There was an email that appeared to be from Visa. I had just recently added more security to my visa account through a new type of authentication, and this email instantly grabbed my attention as being possibly legitimate.

After about three seconds, I knew it was bogus. But it goes to show how a series of events could lead you to believe that an email like this may be legitimate. Another blogger, I can't remember who, referred to it as a "perfect storm situation".

Here it is, read below for the numerous red flags that will make it impossible to be from Visa.

Verifyed by VISA - Multiple Password Failure

Dear VISA Credit Card Member ,

VISA Credit Card is devoted to keeping a safe environment for its community of consumers and producers. To guarantee the safety of your account, VISA Credit Card deploys some of the most advanced security measures in the world and our anti-fraud units regularly screen the VISA Credit Card database for suspicious activity.

We recently have discovered that multiple computers have attempted to log into your VISA Credit Card Online Banking account, and multiple password failures were presented before the logons. We now require you to re-validate your account information to us. If this is not completed by February 31, 2006, we will be forced to suspend your account indefinitely, as it may have been used for fraudulent purposes. We thank you for your cooperation in this manner.

In order to confirm your Online Bank records, we may require some specific information from you.

Please
Click Here or on the link below to verify your account

http://www.visa.com/verification/update/

Thank you for your prompt attention to this matter. Please understand that this is a security measure meant to help protect you and your account.

We apologize for any inconvenience.

If you choose to ignore our request, you leave us no choice but to temporary suspend your account.

VISA Credit Card Security Team

  1. They've spelled verified wrong in their subject! You would think with the amount of time and effort they put into these scams, that spelling would be the first thing they would get right, but thankfully almost all of the email phishing attempts I've seen have horrible spelling and grammar.

  2. They make reference to having this problem cleared up by February 31, 2006. Wow, looks like I'll never get this problem cleared up.  I'd typically wait till the 30th of Feb to handle something like this. There's no way Visa would send out email with an impossible date in the text.

  3. I've removed the actual link target from the "click here" and the link below it from above, as it was actually pointing to www.comsec-data.dk/catalog/admin/backups/ (unlinked for your protection) an international web site, not even close to anything visa would be using. So remember, even if a link looks correct it's too simple to obscure where it really goes, mouse over the link and look at the bottom left status bar in your browser, it will tell you where it really goes.

  4. I did not bother to look at the mail headers, but that's always something you can look at too.

Just remember to not fall for it. No matter how credible it seems, don't talk yourself into it. Call your bank. Call ebay. Call Paypal, call whoever it is claiming to be. Make them prove it's real. If you start down a path, and you feel strange, or you feel it's not legit, close your browser and quit.

Wednesday, February 08, 2006 5:00:09 AM (Pacific Standard Time, UTC-08:00)
I got scammed by an eBay phisher once. I had just sold something online, and I got an e-mail that appeared to have been sent via Messages in eBay, where a buyer was accusing me of taking his money without shipping the product. Eager to clear up the situation I clicked the link, and put in my username and password, only to have it rejected. I tried again, confident that I had the correct log-in information, but this time watched the address bar as it posted. Although the log-in page was at, what appeared to be a valid eBay domain name, posting caused a re-direct to a script at an IP address.
Obviously suspicious, I re-checked the e-mail and found, as you mentioned, various minor spelling errors and inconsistencies. I immediately closed all my browser Windows, and opened a new one, logged into eBay off their actual address and changed my password, then did the same in PayPal.

I'm not a newbie user. In fact I've been on eBay since 1999. I'm not dumb, and I rarely use links in an e-mail for any transaction, preferring to go right to the site. I don't fall for tricks like that, and usually sneer at the poor schmucks who's accounts get hijacked. But all my years of web-savvy didn't help when a phishing attack came in at just the right time. If I didn't know a little bit about how web pages work, I probably would have assumed eBay was having problems and left it for later -- leaving the phishers with my eBay account.

It just goes to show you that the web isn't what it used to be...
Name
E-mail
Home page

Comment (HTML not allowed)  

Enter the code shown (prevents robots):