Is this a new scam?

RumRat

Got two of these just before Christmas. Sent straight to bin and senders blocked.
Sorry but they don't even look convincing.

chrisw

I've recently completed a tax return so had a load of emails from HMRC. They invariably don't give away any information but simply advise that you have a new message and suggest you log on to your account.

There are no links in the emails.

eamon

I wasn't trying to tempt other users. What interested me was the the use of the euro safe methodology and the use of https and the padlock symbol in this scam/phishing attempt. I don't recall seeing that before and no, apart from clicking the links to see where they went to I haven't been compromised.

grumpycrab

eamon wrote: »

no, apart from clicking the links to see where they went to I haven't been compromised.

That's alright then - good luck!

shaun_from_Africa

eamon wrote: »

I don't recall seeing that before and no, apart from clicking the links to see where they went to I haven't been compromised.

"haven't been compromised" should read "I hope I haven't been compromised"

You need to have a good read of this:
https://tiptopsecurity.com/the-truth-about-clicking-links-in-email-and-what-to-do-instead/
before you click on any more links in dodgy e-mails then when you've read that, carry out full malware and virus scans on your computer.

Inner_Zone

Of course it' a scam. If you are due a refund the HMRC will send you warrant (cheque) in the post.

pappa_golf

telephone TXT , do they HAVE your phone number?

debit card ? why , they (if true) would need your bank account number and sort code


PS: its fake

AndyPix

DoaM wrote: »

Not quite ...

Yes it is ..


It is done by exchange servers mainly when using outlook OWA to obfuscate (yes, that is the correct term) the users mailbox details.
The mailbox will be obfuscated and the remaining URL (also obfuscated) will be tagged onto the end.
In your example, ns01 is the name of the mailserver.
In the OP's mail, the bit after "?url=" decodes to
http://Gateway.RefIDConfirmation10aeeec.urefnk.com/&data=02|01||9516af5965dc4962aa4d08d5534ac25a|84df9e7fe9f640afb435aaaaaaaaaaaa |1|0|636506502902824163&sdata=FfFyHh4qWIKnMg 9YLkAXFsaNtbwTTxKfux5WXb0WKpU=&reserved=0
I didn't mean the whole thing was obfuscated by the sender, i was just referring to your comment in the middle of talking about this, to clear up why yours would be NS01
Sorry for any confusion

pmduk

Farway wrote: »

It is an old scam, HMRC never contact anyone to offer a refund

If a refund is due they will automatically adjust your PAYE code

Not quite true, on occasions, you will be sent a SA800, which allows you to log online and request a payment to be made. This isn't done by email, ever.

[Deleted User]

Can't believe people still think that there is a possibility of these scam emails being legit. Some folk just deserve to be scammed for being greedy enough to believe it's real.