Debenhams e-receipt scam - question?

Ant555

Ref the article in the news today about (quote) ' The most convincing internet scam ever'

http://expressdigest.com/cops-warn-over-convincing-debenhams-receipt-phishing-scam/
https://www.v3.co.uk/v3-uk/news/3023870/consumers-warned-about-convincing-debenhams-phishing-emails

There doesn't seem to be a lot of detailed information but does anyone know if this latest email phishing/scam message actually contains valid information?
ie does it just look like a Debenhams e-receipt or is it actually the exact customers e-receipt sent to the specific customers email address for a valid purchase they have made but with scam links in it?

The articles mention 'carbon-copy' of a valid e-receipts but I cant work out if its a generic e-receipt sent to many or a carbon copy of the real one.

If this is actually a scam message for a valid purchase with a valid date/time of purchase sent to the registered email address then it would definitely be a big issue (especially for Debenhams to work out how the data was stolen fro their systems!)

Thanks

AndyPix

Your_Link wrote: »

While the emails copy a typical Debenhams email receipt - one sent to customers after they have purchased or ordered something in-store - they are easily given away by the fact that they come from a clearly non-Debenhams address.

New twist on an old scam.
IMHO, in this day and age, people who dont look out for these things sort of deserve what they get

Ant555

AndyPix wrote: »

New twist on an old scam.
IMHO, in this day and age, people who dont look out for these things sort of deserve what they get

they are easily given away by the fact that they come from a clearly non-Debenhams address.

Thanks - I get all that but why is this particular scam being singled out in some of the news? I'm thinking it is just 'fake news' as they say and ive picked up on a non-story or is the scam e-receipt being received by some recipients containing details of purchases they HAVE actually made.

AndyPix

Well Debenhams were hacked back in May last year, so it's entirely possible that the hackers - or the people who they sold the data to, have held onto it until the hype has blown over (now) and then used peoples accounts to monitor sales and send these shady invoices in advance of the real ones.


Even more devious would be if they combined the hacked data with other data and accessed the email account of the victim to delete the original e-receipt


This would be quite devious as it would mean hiding in the shadows so as not to alert the user to change their passwords


Which they should have done following the breach