Suspicious email from Fidelity

thenudeone

I've just received a professional-looking colour email addressed to me by name apparently from fidelity investments advising me of a service upgrade to the secure document facility. I DO have a Fidelity account,

When I hover over any of the links, the real ULR begins http:// emails-fidelity . co . uk/ [broken for security]

Here is the Whois record:

Domain name:
emails-fidelity.co.uk
Registrant:
Abstracts
Registrant type:
Unknown
Registrant's address:
102 Clerkenwell Road
London, London
London
EC1M 5SA
United Kingdom
Registrar:
Easily Limited t/a easily.co.uk [Tag = WEBCONSULTANCY]
URL: http://www.easily.co.uk
Relevant dates:
Registered on: 11-May-2010
Renewal date: 11-May-2012
Last updated: 29-Nov-2010
Registration status:
Registered until renewal date.
Name servers:
ns0.dns.dotmailer.co.uk 94.143.104.162
ns1.dns.dotmailer.co.uk 80.249.108.165
WHOIS lookup made at 12:26:48 20-Jan-2012

easily.co.uk is a bargain bucket domain provider and unlikely to be used by a major investment company (and is not the provider of fidelity.co.uk)

102 Clerkenwell Road, London is a Karaoke Bar!
http://maps.google.co.uk/maps?q=102+Clerkenwell+Road%0A+++++++++London,+London%0A+++++++++London%0A+++++++++EC1M+5SA&um=1&ie=UTF-8&hq=&hnear=0x48761b51ce1a9393:0x7c5cf02e4bfc0bdf,102-108+Clerkenwell+Rd,+London+EC1M+5SA&gl=uk&ei=n10ZT42XFdOi8gOS9vm0Cw&sa=X&oi=geocode_result&ct=title&resnum=1&ved=0CCIQ8gEwAA

So I'm 99.9% certain that this is a phishing scam.

But it concerns me that they have both my name and email address.

I get lots of phishing attempts every day on email addresses of a club I belong to, which are published on the web. Most are plain text emails with generic (un-named) greetings, poor english, pointing to obviously suspect URLs and often without even spoofing the "from" address; but this one is in a different league altogether. BEWARE.

buffman

I too received a similar email, though I suspect that it is genuine. As a rule even when I believe an email to be genuine, I never follow a link to a secure web page, but instead get to the page using another route.

dtsazza

buffman wrote: »

I too received a similar email, though I suspect that it is genuine. As a rule even when I believe an email to be genuine, I never follow a link to a secure web page, but instead get to the page using another route.

That would be my advice, and would likely verify whether the mail is genuine or not.

Go to the Fidelity website by typing the URL yourself (or using a Favourites/bookmark if you have one), then log into your account area. If there's any actions they need from you it should be quite obvious, and presented to you as something like a flashing exclamation mark icon!

Then again, the "we're upgrading our systems so you have to reconfirm your password" is unlikely to be true, since it's very unlikely that this would be a technical requirement. So it smells a lot like a phishing mail.

buffman

Nowhere on my email was there a password request. The email was simply informing that there has been a 'service upgrade' and most future correspondence will not be through the post but available by viewing your account on their website. Hence no reason to believe that the email is suspicious.

Eco_Miser

thenudeone wrote: »

When I hover over any of the links, the real ULR begins http:// emails-fidelity . co . uk/ [broken for security]

Here is the Whois record: <snipped rest of record>

Registrant's address:
102 Clerkenwell Road
London, London
London
EC1M 5SA
United Kingdom

102 Clerkenwell Road, London is a Karaoke Bar!
http://maps.google.co.uk/maps?q=102+Clerkenwell+Road%0A+++++++++London,+London%0A+++++++++London%0A+++++++++EC1M+5SA&um=1&ie=UTF-8&hq=&hnear=0x48761b51ce1a9393:0x7c5cf02e4bfc0bdf,102-108+Clerkenwell+Rd,+London+EC1M+5SA&gl=uk&ei=n10ZT42XFdOi8gOS9vm0Cw&sa=X&oi=geocode_result&ct=title&resnum=1&ved=0CCIQ8gEwAA

At the same address (on the upper floors?) is a bulk mailing company, who presumably are Fidelity's contractors for such mailings, and have registered their own domain for them. http://www.dogstardesign.co.uk/
You're right to be suspicious though, and being a legitimate company doesn't prove they're not phishers.

thenudeone

I forwarded the email to an address on their website and have now received their response:

Dear xxxxxxxx

Thank you for contacting Fidelity.

The email that you have received is a marketing mail sent by Fidelity in regards to an online services facility that can help clients reduce their paperwork.

As we do not consider normal email to always be a secure means of communication, we can only give general information about our procedures here. Clients who require account-specific information should write or call us on the details available in the Contact us section, or log in with their Customer Reference Number at https://www.fidelity.co.uk

You can also contact us by calling the telephone number available on our website. One of our associates will be happy to assist you.

For identification and security purposes, whenever clients contact us by telephone, we will ask for their customer reference number. This is a ten-digit number starting with a one.

Yours sincerely

To say I am surprised that they are party to an email sent in such an amateur fashion is an understatement.

middlepuss

I haven't received this email, but I recently had a hardcopy mailing from Fidelity saying I can no longer give instructioins by letter - I now have to fill in a form.

Like most Fidelity correspondance, the letter is poorly designed and impersonal. I have found that dealing with Fidelity is like dealing with a huge international machine rather than a team of UK human beings. The last letter I sent them never got actioned.

All in all I have found Fidelity's interaction with me as an investor to be poor so it does not surprise me that you received a genuine email from them that looked like spam junk.