TFL 5% savings account scam

juliahowes

I've reported this email the moment I received it (~8am this morning) to:

1. abuse-complaints@squarespace.com (their domain and hosting provider)
2. abuse@mailchimp.com (their mailing list provider)
3. report@phishing.gov.uk (Action Fraud)
4. fraud@tfl.gov.uk (Later edit, just for good measure)
   

SquareSpace responded to me almost immediately and said they're looking into it, and the website was taken down.

MailChimp responded just recently with generic response.

I now see their website is back online with the same URL (tfl-uk.com), so the quest continues...

masonic

juliahowes said:

I now see their website is back online with the same URL (tfl-uk.com), so the quest continues...

This is extremely annoying as they don't appear to have changed hosting provider, so it appears Squarespace has re-enabled it.

juliahowes

masonic said:

juliahowes said:

I now see their website is back online with the same URL (tfl-uk.com), so the quest continues...

This is extremely annoying as they don't appear to have changed hosting provider, so it appears Squarespace has re-enabled it.

That's right. I've already followed up on my ticket with SquareSpace and sent them a link to this discussion (if they need more "proof"). I've also forwarded the email to fraud@tfl.gov.uk, just in case they'd want to hear about the site using their branding and name. Stay tuned.

masonic

Likewise. I've also reported to Google Safe Browsing. That should cover off most major browsers. If someone able to run MS Edge browser can flag to Microsoft SmartScreen I'd be grateful (apparently the option is in the help menu).

Rheumatoid

masonic said:

Likewise. I've also reported to Google Safe Browsing. That should cover off most major browsers. If someone able to run MS Edge browser can flag to Microsoft SmartScreen I'd be grateful (apparently the option is in the help menu).

Done   ...

david72

masonic said:

The email address I received this at suggests a data breach where email addresses used with TFL have been harvested.

Well spotted, and thanks for taking action. If you think the email addresses were stolen or misused from TfL data (eg, a unique email address which you have only ever used with TfL), it would also be worthwhile contacting the Information Commissioner's Office as well, so that they can investigate whether TfL (or their data processors) have been hacked or whether a rogue employee has stolen the data.

mjm3346

MSE have mentioned before a site you can use to check if your e-mail address has been exposed  - not sure how long it takes for one to show up

https://haveibeenpwned.com/

london21

Scammers are becoming more wild. A transport company now financial investment company also now.

If it sounds too good, it probably is.

Importance to check everything before putting a penny in. 

callum9999

london21 said:

Scammers are becoming more wild. A transport company now financial investment company also now.

If it sounds too good, it probably is.

Importance to check everything before putting a penny in. 

I'd personally say the old Nigerian prince etc. scams are far wilder than TfL allegedly trying to raise funds from some kind of publicly available bond!

masonic

mjm3346 said:

MSE have mentioned before a site you can use to check if your e-mail address has been exposed  - not sure how long it takes for one to show up

https://haveibeenpwned.com/

No pwnage found in my case. The address I used was unique to TfL. However, that site also says the same about another email address I know was subject to a breach, so I don't think it is very reliable.