Don't be caught - Phishing Discussion

ks62uk

I received an email today from Virgingroup.org , congratulating me on winning a lottery and a substantial amount of money, as below:

- strikes me as a scam as the domain was registered on 2nd Sep 06, and email was sent via webmail !

Any thoughts ... anybody else received this?

[ header info:
Received:
* from wmail.registermydomain.com ([82.110.78.151] helo=mail.registermydomain.com) by asmtp.asmtp.com with esmtp (Exim 4.30) id 1GKXrR-0003cI-7O; Tue, 05 Sep 2006 11:08:53 +0100
* from 87.74.17.121 (unverified [87.74.17.121]) by mail.registermydomain.com (VisualMail 4.0) with WEBMAIL id 22342; Tue, 05 Sep 2006 11:00:01 +0000

Return-path: <nicolegrant@virgingroup.org> ]

whois info:

[Domain ID:D128206526-LROR
Domain Name:VIRGINGROUP.ORG
Created On:02-Sep-2006 12:56:29 UTC
Last Updated On:02-Sep-2006 17:06:26 UTC
Expiration Date:02-Sep-2007 12:56:29 UTC
Sponsoring Registrar:OnlineNIC Inc. (R64-LROR)
Status:CLIENT TRANSFER PROHIBITED
Status:TRANSFER PROHIBITED
Registrant ID:ONLC-2310174-4
Registrant Name:mr p hall
Registrant Organization:Not Applicable
Registrant Street1:7 pound green court 31 parkhill road bexely
Registrant Street2:
Registrant Street3:
Registrant City:london
Registrant State/Province:bexely
Registrant Postal Code:da5 1jp
Registrant Country:GB
Registrant Phone:+4.42083037777 [this phone no. is Bexley Council ie bexley.gov.uk !]
Registrant Phone Ext.:
Registrant FAX:+1.2345678
Registrant FAX Ext.:
Registrant ***************@yahoo.ca ]

<quote>
We are officially informing you of the result of the Lottery Winners
International programs held on the 30th of August, 2006 as part of our
promotional programs for the year 2006.

Total funds have now been deposited and insured with our affiliate
security firm (Bank) for transfer into your nominated bank account
either by means of wire transfers through any of our correspondent
banks or any other means suitable to you. We also advice that you keep
your winning information very confidential as our security policy
demands to avoid double claims/impersonation and unwarranted abuse of this
program by some individuals.
All participants were selected through a random computer ballot system
drawn from over 800,000 company and 1,000,000 individual email addresses
and names from all over the world. This promotional program takes place
annually and we hope with part of your winning you will take part in our
next year £20 Million Pounds International Lottery.To file for your claim,you
will be contacting our Verification Department authorized to verify and process
your claims for your total payment (You will receive more information upon your
acknowledgment of this email).

To file for your claim, please contact our Verification Department:
Ms.Kelly Stone Reply Email : kellyatvig@yahoo.com

This lottery is promoted and sponsored by software corporations and
other private organizations to help individuals generate fortunes which
would encourage them to expand their business frontiers thereby
creating more opportunities and assisting with humanitarian concerns within
their immediate environment. Please Note that winnings must be claimed not
later than 7th of September, 2006. After this date all unclaimed funds will be
included in our subsequent program coming up later in 2007. In order to
avoid complications always quote your reference number in all
correspondence.
Furthermore, should there be any change of address do inform us as soon
as possible. Congratulations from our organization and thank you for being
part of our promotional program.
NOTE:
(1) Anybody under the age of 18 is automatically disqualified from this
program.
(2) To file for your claim, please contact our Verification Department:
Ms. Kelly Stone Reply Email : kellyatvig@yahoo.com

Sincerely yours,
Ms. Nicole Grant
Programs & Events coordinator
(Virgin Investment Group)

[/quote]

lucyelastic1

Over the last couple of weeks both myself and my partner have received numerous telephone calls on both our landline and mobiles allegedly from our Bank. They ask for us by our full names and say they are from our bank whose name they quote. They then ask us for our account details including our pin number. We have even taken their number and rung them back. The number goes straight to a recorded message telling us that they have tried to contact us (!) without success.

Of course we have contacted our bank and they inform us that these calls are a scam and that they have been alerted by several other account holders. My question are:
1. How do they get our contact details - I say because somebody is on the take and selling these details.
Be warned fellow moneysavingexpert people. Do not, on any account give any details (even to the point of confirming your name) without getting their details. Then, you ring your bank and tell them what is happening. I expect they will then confirm an attempt has been made to rip you off.
I am spitting mad that some sad git has sold our details to some rip off merchants. GRRRRRR!

madauri

ks62uk wrote:

I received an email today from Virgingroup.org , congratulating me on winning a lottery and a substantial amount of money

Definitely spam. For if the fact that they want you to contact a yahoo address were not enough (a valid organisation would have their own domain addresses, if you do a google on virgingroup.org you'll find it's blacklisted as a 149 spam.
Delete and ignore.

madauri

lucyelastic1 wrote:

1. How do they get our contact details.

It seems they've got just your number and your bank, no names or anything. So I'm inclined to think the info comes from your phone company.

mikeD

ks62uk wrote:

I received an email today from Virgingroup.org , congratulating me on winning a lottery and a substantial amount of money, as below:

[/QUOTE]I got one a few days ago from asolaceagenci.com signed by a Mrs Anita Raynes and based in Madrid. It said that I had won 787K US Dollars and should reply to a given email address. Also got a similar one in the previous month quoting a different lottery which I dumped. How lucky can I be, two wins in two months.

Should I report this to my ISP or someone else?

downie_2

Hi mikeD,
Firstly you should check out the email address you are being asked to reply to.
If the part after the '@' is a common email supplier like hotmail.com, yahoo.com or gmail.com, you should forward the email with your complaint to their abuse department. You can find the right address using http://www.dnsstuff.com - half way down the left hand side of that page there is a box marked "Abuse Lookup'.
If you do not recognise the part of the address after the @ , it may be a domain set up for fraud. You should check this by doing a WHOIS lookup, again on the dnsstuff page just above 'Abuse Lookup' there is a box 'WHOIS Lookup'.
If for example the email address is claims@salottery.com, you look up salottery.com . If the domain has been registered recently and for the minimum period of one year, it is probably fraudulent. In that case you should complain to the REGISTRAR ('sponsoring registrar','registrar of record') which should be mentioned in the WHOIS and whom you can look up an address for using 'Abuse Lookup'....
For example the WHOIS for virgingroup.org says in part

Domain ID:D128206526-LROR
Domain Name:VIRGINGROUP.ORG
Created On:02-Sep-2006 12:56:29 UTC
Last Updated On:02-Sep-2006 17:06:26 UTC
Expiration Date:02-Sep-2007 12:56:29 UTC
Sponsoring Registrar:OnlineNIC Inc. (R64-LROR)

It was registered on 2nd Sept for 1 year. The registrar is Onlinenic - actually onlinenic.com is who you have to find an abuse address for in this case.
Finally you can report the email as spam, either to your email provider or to an organisation such as Spamcop.
Hope this helps and thanks for your vigilance. PM me if you get stuck.
downie

achtunglady

doingwhatican wrote:

I had a couple in the last couple of days. one email trying to pretend to be paypal anti fraud - that made me laugh and another one pretending to be a ask the seller a question email. They had even gone to the trouble of using an item descripion and item number of what I was selling. I put the mouse curser over the respond now link and it had a very long non ebay link. I copied and pasted the link and removed my account name and email address then clicked on it and it took me to a very good copy of the ebay logon screen, where I proceeded to put in lots of very funny usernames and password, I only did this for a few minutes as I soon got bored of it. I can imagine people getting caught out by this. On closer inspection you could see the mistakes that they had made in trying to copy the ebay email and logon screen.

I got a few of these too, don't they realise that genuine communication goes into your "my ebay" screen?
I usually put in "u r a phisher" in the username and "f**koff as the password, and i put in an expired credit card number in where they want to verify and i put 112 as the cvv code(code for police) and pin number i put in 0000
I imagine them at the other end, jumping for joy thinking some mug has put in their real details, then realising they have been taken for a mug!!!

BritBrat

I am not sure you can still get free accounts that work the same but I would guess you could.

Maybe you already have a Freeserve account?

Now here is my tip and I have been using it for years, you may need to login to the account every 3 months to keep it active but it will not cost more than 50p for the year.

OK so you have an account name:

you@yourname.freeserve.co.uk

Well the "you" part can be anything at any time, so when you are signing up for say Ebay you give them the Email: ebay@yourname.freeserverve.co.uk so if you get a fishing mail trying to get your Ebay account details you look at the address and if it's not "ebay@yourname.freeserverve.co.uk" you know it's not from them as you only give Ebay that address and no one else.

Same applies to banks and any other site, another advantage is to now make a rule to filter the account with "ebay@yourname.freeserverve.co.uk" into a folder called Ebay and it will not get lost in all the spam.

You may have to check how Orange (Freeserve, Wannado) now format thier Email system, but I know others do the same thing so test what you already have and send a mail to yourself to test it out.

Works great for me and saves me giving out my broadband email account to anyone apart from known friends and family.

trisontana

I received this one today :-

"Dear Client of Halifax Online!

Summer 2006 has been hard for our Bank due to the increasing number of
clandestine practices.
Sensible information about our clients is of constant interest for
swindlers. Lots of people seek protection from the hazard of losing money
from their bank accounts.

In this respect, Bank announces that September is the fraud-fight month.
Before Octomber 1st all our clients should activate new account protection
system.
We have upgraded and considerably improved it. Top EFT specialists tested
the system, and independent experts have already affirmed its reliability.
We do not publish this information in mass media in order that malefactors
could not employ it criminally.

You have been randomly chosen for the final testing of the account
protection system.
Now we offer you to go to xxxxxxxxxxxxxxxxxxx and activate the new security
system by entering the Internet banking as always. Currently you may notice
some defects. We are aware of them so you do not have to inform us of these
problems, we shall obviate the difficulties on our own.

Please note that on and after September 1st you will have to use the new
security system, otherwise your account will be blocked until your identity
is proven.
That is why we strongly recommend changing over to the new security
standard as soon as possible.

Best regards,
Fraud Fight Department
Halifax Online"

As you can see from the rather peculiar English this is about as genuine as an £18 note. I suppose some sucker will fall for this.

sir_monster

Third attempt in three days - do these guys sell on your details or what seems a bit dodgy.


Dear Customer,
Nationwide's Internet Banking, is here by announcing the New Security Upgrade.
We've upgraded our new SSL servers to serve our customers for
a better and secure banking service,against any fraudulent activities. Due to
this recent upgrade, you are requested to update your account information by
following the reference below.



http://www.nationwide.co.uk/update. asp?ID=3b89db2a6001ec93328d21e59a011b0a 25a
Regards
Rafiq Miah
Customer Advisor
Nationwide Direct
Nationwide Building Society