How did they get hold of my mse email and username?

mrscruffy

Hi, See below for an email I received this morning (with a dodgy looking attachment)! Somehow both my email and moneysavingexpert.com username are correct which leads me to believe that the forum has been hacked into and my details retrieved. I'd suggest a global email to all users warning them as it looks pretty convincing to the less IT savvy users.

p.s. I have emailed direct to the webmaster but want to make sure this gets through.

> mrscruffy,
>
> At MoneyExpert, we believe it's only fair that you can compare products
> from the whole of the marketplace. After all, it's the only way to be sure
> you're not missing that perfect deal. That's why we insist on being
> independent, which means we're never biased towards any particular
> company. We provide details on every product from all of the major > providers in the market. We partner with Defaqto, the people who deliver
> product data to the FSA, to ensure that our tables are accurate and
> complete. You can find out more about Defaqto atwww.defaqto.com.
>
> Download News-Tool:
>
> *** URL REMOVED ***
> _________
> MoneyExpert.com
> MoneyExpert is VAT registered. Our VAT registration number is 825281335.
>
>

spadoosh

the email is from moneyexpert.com not moneySAVINGexpert.com

12bdebt3

You've probably got a quote from a loan company like YesLoans who like to send out 3000 emails and make 10 calls a day and they've sold on your details. You should be able to unsubscribe or spam it.

mr_fishbulb

mrscruffy wrote: »

Somehow both my email and moneysavingexpert.com username are correct

Does your email address begin "mrscruffy@"?

jaydeeuk1

I got this too and my email is completely different to my username. I do use this username on other forums though.

stevemcol

arrontdep wrote: »

You've probably got a quote from a loan company like YesLoans who like to send out 3000 emails and make 10 calls a day and they've sold on your details. You should be able to unsubscribe or spam it.

Do not 'unsubscribe' from dodgy looking emails. I just confirms you are a real person.

credithater_2

I received the exact same email with my forum id included about an hour ago.

The URL for downloading the tools is completely different to the email address !!

Working in IT I see so much of this, and it just makes more angry everytime I see one. 98% of all email in our company is spam, phishing or medical enhancement emails. It's ridiculous :mad:

FrugalDougal

Hi,

I received this also. I have never used my MSE username and the specific email address *anywhere* else. MSE techies - what's up?

Jacqui

12bdebt3

stevemcol wrote: »

Do not 'unsubscribe' from dodgy looking emails. I just confirms you are a real person.

I mentioned spam to cover this, maybe I should've gone into detail haha.

scottishlass

There are quite a few threads on this if you go to this one then you can see a couple of responses from MSE https://forums.moneysavingexpert.com/discussion/2866884

DaleN

I also got one of those emails this morning at 10.39am. It claimed to come from moneyexpert.com but the message headers showed it originated at server.webconsult.no

I can create different email addresses for myself on the fly, and use a different one for each website I use so I can see where the spam comes from. This email was addressed to my MoneySavingExpert email address, and also used my login name (which is unrelated to the email address).

Here are the full headers of what I received (with my details changed to xxx, of course)...

Delivered-To: xxx@gmail.com
Received: by 10.229.242.14 with SMTP id lg14cs20707qcb;
Wed, 17 Nov 2010 02:39:11 -0800 (PST)
Received: by 10.224.207.202 with SMTP id fz10mr7688767qab.213.1289990351900;
Wed, 17 Nov 2010 02:39:11 -0800 (PST)
Return-Path: <vivario@server.webconsult.no>
Received: from mail4.zoneedit.com (mail4.zoneedit.com [66.223.51.217])
by mx.google.com with ESMTP id m23si4990636qck.186.2010.11.17.02.39.11;
Wed, 17 Nov 2010 02:39:11 -0800 (PST)
Received-SPF: neutral (google.com: 66.223.51.217 is neither permitted nor denied by best guess record for domain of vivario@server.webconsult.no) client-ip=66.223.51.217;
Authentication-Results: mx.google.com; spf=neutral (google.com: 66.223.51.217 is neither permitted nor denied by best guess record for domain of vivario@server.webconsult.no) smtp.mail=vivario@server.webconsult.no
Received: from server.webconsult.no (unknown [72.34.32.139])
by mail4.zoneedit.com (Postfix) with ESMTP id 9EBBC19A1926
for <xxx@xxx.net>; Wed, 17 Nov 2010 05:39:10 -0500 (EST)
Received: from vivario by server.webconsult.no with local (Exim 4.69)
(envelope-from <vivario@server.webconsult.no>)
id 1PIfPw-0001XG-RJ
for xxx@xxx.net; Wed, 17 Nov 2010 11:39:08 +0100
To: xxx@xxx.net
Subject: From MoneyExpert.com to DaleN
From: admin@moneyexpert.com
Message-Id: <E1PIfPw-0001XG-RJ@server.webconsult.no>
Date: Wed, 17 Nov 2010 11:39:08 +0100
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - server.webconsult.no
X-AntiAbuse: Original Domain - xxx.net
X-AntiAbuse: Originator/Caller UID/GID - [32201 32202] / [47 12]
X-AntiAbuse: Sender Address Domain - server.webconsult.no