Safe Computing
Safe Computing Home | Protect Your Computer: Operating System, Firewall, Antivirus | Protect Your Information: Email, Social Networking, Passwords, Browser Security, Wireless, Sensitive Data, File Sharing | Getting Help: Compromises, Harassment, Account Recovery, cMail Remediation
The Phish Pharm: Examples of email scams
Email Scam Example 24
From: University of Chicago [mailto:info@uchicago.edu]
Sent: Friday, May 29, 2009 3:57 AM
To: undisclosed-recipients:
Subject: URGENT
Dear Staff And Student,
This Email is from University of Chicago and we are sending it to every Accounts Owner for safety. we are having congestion's due to the anonymous registration of web mail accounts so we are shutting down some webmail accounts and your account was among those to be deleted. We are sending you this email so that you can verify and let us know if you still want to use this account. If you are still interested please confirm your account by filling the space below. Your Username,password,date of birth and your country information would be needed to verify your account.
Due to the congestion in all mail users and removal of all unused webmail Accounts, webmail would be shutting down all unused Accounts, You will have to confirm your E-mail by filling out your Log in Information below after clicking the reply button, or your account will be suspended within
24 hours for security reasons.
*Email Username :..............
*Email Password :..............
*Date of Birth :..................
*Country or Territory: .........
After following the instructions in the sheet, your account will not be interrupted and will continue as normal. Thanks for your attention to this request. We apologize for any inconveniences.
Warning!!! Account owner that refuses to update his/her account after 48 Hours of receiving this warning will lose his or her account permanently.
Thanks.
University of Chicago.
Although this email looks convincing because of lack of obvious typo and grammatical mistakes, NSIT will never ask you to verify your password over email.
Email Scam Example 23
From: University of Chicago Technical Support Team [web-upgrade@uchicago.edu]
Sent: Wednesday, April 15, 2009 4:22 AM
Subject: Dear Valid Customer
Dear University of Chicago Webmail Subscriber,
We are currently carrying-out a mantainace process to your uchicago.edu account, to complete this, you must reply to this mail immediately, and enter your User Name here (..............) And Password here(..............) if you are the rightful owner of this account.
Due to the Junk/Spam emails you receive daily, we are currently upgrading all email accounts Spam filter to limit all unsolicited emails for security reasons and to upgrade our new features and enhancements with your new and improved E-mail account, to ensure you do not experience service interruption.
This process we help us to fight against spam mails. Failure to summit your password, will render your email address in-active from our database.
NOTE: If your have done this before, you may ignore this mail. You will be send a password reset message in next three (3) working days after undergoing this process for security reasons.
Thank you for Using uchicago.edu,
NSIT will never ask you to verify your password over email. The numerous typos and grammatical mistakes, such as "carrying-out" and "mantainace," also give it away as a scam.
Email Scam Example 22
From: Senator David Mark [mailto:info@atm.com]
Sent: Tuesday, April 14, 2009 9:49 PM
Subject: OUR REF:FRN/ATM/882
OUR REF:FRN/ATM/882
YOUR REF:CLAIMS/ATM/882
This is to officially inform you that(ATM Card Number;(5179123456789120) has been accredited in your favor.Your Personal Identification Number is 882. The ATM Card Value is $6.8 MILLION USD.You are advice to contact Mr Jeffery Simpson via Email(firstflightservice@yahoo.com.hk) with the following information's;
Full Name:
Delivery Address:
Phone Number:
Country:
OCCUPATION:
SEX:
Age:
Please Note that you are to pay the sum of $85 USD for the delivery of your ATM Card by FedEx Courier Express
Best Regards,
Senator David Mark.
The numerous typos and grammatical mistakes of this email give it away as a scam. It is highly unlikely that a foreign senator will give away ATM cards. The reply email addresses are likely fake.
Email Scam Example 21
From: mansion@usc.edu [mailto:mansion@usc.edu] On Behalf Of Capital One
Sent: Wednesday, November 26, 2008 8:42 AM
Subject: Customer Alert
Dear Capital One Cardholder,
During our regularly scheduled account maintenance and verification procedures, we have detected a slight error regarding your Capital One Card(s).
This might be due to one of the following reasons:
1. A recent change in your personal information (i.e. address changing) 2. Submitting invalid information during the initial sign up process.
4. Multiple failed logins in your account.
3. An inability to accurately verify your selected option of payment due to an internal error within our system.
Please update and verify your information by clicking the following link:
http://servicing.capitalone-iv.com/c1/login.aspx
Note: You must verify your information before you can continue using your card.
Thank you,
Capital One.
The "usc.edu" domain in the "From" address is a give away that this is a phishing scam. Also the link to the Capital One website is most likely fake.
Email Scam Example 20
From: The Unversity Of Chicago Webmail Team [mailto:abuse@uchicago.edu]
Sent: Sunday, November 16, 2008 5:27 PM
Subject: Uchicago.edu Webmail Account Update
Dear Uchicago.edu Staff/Student,
We are contacting you to remind you that our Account Review Team identified some unusual activity in your Uchicago.edu Webmail Account. As a result, access to your account has been limited in accordance with Uchicago.edu Webmail Online User agreement. Your account access will remain limited until this issue has been resolved. You are therefore required to provide the information below;
° Uchicago.edu Webmail complete CNetID (**********) and Password(********)
*Important*
Please provide all these information completely and correctly otherwise due to security reasons we may have to close your account temporarily.
We thank you for your prompt attention to this matter.Please understand that this is a security measure intended to help protect you and your Uchicago.edu Webmail Account. We apologise for any inconvenience.
Thanks
The Unversity Of Chicago Webmail Team
Copyright © 2008 - Uchicago.edu - All Rights Reserved
NSIT will never ask you to verify your password over email.
Email Scam Example 19
From: THE UNIVERSITY OF CHICAGO [ccbest@asu.edu]
Sent: Sunday, November 16, 2008 3:40 AM
Subject: REPLY A.S.A..P
Dear Subscriber,
We would like to inform you that we are currently carrying out scheduled
maintenance and upgrade of our webmail service and as a result our email
client has been changed and your orignal password will be reset. We are
sorry for any inconvenience caused.
To complete your uchicago.edu email account, you must reply to
this email immediately with the information below
1)Username:
2)Password:
Failure to do this will immediately render your email address deactivated
from our database.
You can also confirm your email address by logging into your uchicago.eduaccount at
https://webmail.uchicago.edu/
Thank you for using
The University Of Chicago Webmaster@uchicago.edu
Although the links in the email go to real University of Chicago websites, the email is not sent from a University of Chicago email address, and you will never have to verify your password over email.
Email Scam Example 18
From: news@uchicago.edu [mailto:news@uchicago.edu]
Sent: Friday, November 14, 2008 8:55 AM
Subject: Important News - Please Read
Please click the link below to read important news about University of Chicago:
https://nsit.uchicago.edu/cmail/login (http://nsit.uchicagoedu.net/cmail/)
Regards,
The University of Chicago
Although this email looks convincing because it asks you to go to cMail, the actual URL (discovered by mousing over the link) was not a University of Chicago website.
Email Scam Example 17
From: The uchicago.edu Support Team [noreply@uchicago.edu]
Sent: Tuesday, November 4, 2008 1:56 PM
Subject: Uchicago.edu Account Update
Reply-To: noreply@uchicago.edu
Dear Subscriber,
We are currently upgrading your uchicago.edu email accounts with the
following features:
Spam Protection,
Unlimited storage
Offline access with POP
Filters
Live Customer Care
Mail Forwarding
Address Guard / Disposable addressees.
Unlimited Web2sms
All uchicago.edu users must visit this link:
http://webmail-uchicago-update.tk
and login their email account via uchicago.edu secure channel for
high
security account protection.
Regards
The uchicago.edu help centre.
Although this email could be convincing because of the lack of obvious typos and the email address domain, the link is not to a University of Chicago website.
Email Scam Example 16
From: university of chicago [university@muw.edu]
Sent: Tuesday, October 21, 2008 6:01 AM
Subject: REPLY A.S.S.P
Good-day,
This is to notify the entire University of Chicago that we would be upgrading our server,so we want you to send the following information,in order to keep your account still active after the upgrade.
1)Username:
2)Password:
We would want you to acknowledge this email asap.
cheers..
From the Administrator The University of Chicago
5801 South Ellis Avenue
Chicago, Illinois 60637
(773) 712-1234
This email is not sent from a University of Chicago email address, and you will never have to verify your password over email.
Email Scam Example 15
From: Uchicago webmail support [mailto:webmailsupport@uchicago.edu]
Sent: Tuesday, September 02, 2008 4:38 AM
Subject: Password verification
As part of our security measures, we regularly screen activity in the Uchicago Webmail system and after noticing an issue on your account password, we are requesting confirmation from you for the following reason:
Our system requires further password verification.
In accordance with Uchicago Webmail User Agreement, your account access will remain limited until the issue has been resolved. Unfortunately, if access to your account remains limited for an extended period of time, it may result in further limitations or eventual account closure.
To verify your Uchicago Webmail account, you must reply to this email
immediately and enter your password here (*********)
Thank you for using UChicago webmail
The Uchicago support team
You will never have to verify your password over email.
Email Scam Example 14
From: kb0011@optimum.net [mailto:kb0011@optimum.net]
Sent: Tuesday, August 12, 2008 11:01 AM
Subject: Dear Account User Student webmail
Dear Account User Student webmail,
This message is from school webmail,messaging center to all student account owners. We are currently upgrading our data base and e-mail account center. We are deleting all unused school Email,account to create more space for new accounts.
To prevent your Account from closing you will have to update it by providing
the information requested below:
Confirm Your Account Details
----------------------------
Webmail ID:
Password:
D.O.B:
---------------------------------------
You will be sent a new confirmation alphanumerical password so that it
will only be valid during this period and can be changed after the
process.Thanks for your understanding.
School Administrator Problem.
Warning!!! Account owner that refuses to update his or her account within seven days of receiving this warning will lose his or her account permanently
Not only is this email not sent from a University of Chicago email address, the obvious typos and poor attempt at approximating "professional" email style mark this as a scam.
Email Scam Example 13
From: Webmail Upgrading Service [mailto:upgradinservice@info.com]
Sent: Monday, August 25, 2008 7:10 AM
Subject: [SPAM:#] Webmail Upgrading Service
Dear Subscriber,
Due to spam complaints of email users in our webmail system, our investigation shows that your email address is compromised and is used to send out spam message in our webmail system.
As a result, our network engineer will be conducting a maintenance in our webmail system, your Username will be disabled if you do not send us the required information within 48hrs.
Informations Required:
Your Full Names:
Email address:
Password:
Retype Password:
E-mail: account-teamdept@live.com
We value your business and thanks for using our Webmail Service.
Maintenance Webmail Team.
Though this email could be convincing because of the lack of obvious typos and the use of Webmail, it is important to notice that it was not sent from a University of Chicago email address and contains no mention of the University.
Email Scam Example 12
From: jk4km@cogeco.ca [mailto:jk4km@cogeco.ca] On Behalf Of Uchicago
Sent: Tuesday, August 19, 2008 8:38 AM
Subject: [Chicago Card] Dear Uchicago.Edu.User
Dear Uchicago.Edu.User.
This mail is to notify all users that the site will be undergoing upgrade in a couple of days from now.
Hence, as a user of Uchicago.edu, you are required to send us your email account details to enable us acknowledge
account activeness Furthermore, be informed that we will be deleting all mail account that is not active so as to create
more space for new users.
Therefore you are advice to send us your mail account details As requested below
*User name:.........
*Password:..............
*Date of birth:................
*Security question:.............
*Security answer:.....................
All users (Uchicago.edu) are advise to complete this update.
Regards
Mark Anderson
Tech/Maintenance officer
The address from which this email was sent is obviously not a University email address. The numerous typos and unprofessional tone of this email also give it away as a scam.
Email Scam Example 11
From: avoth@cogeco.ca [mailto:avoth@cogeco.ca] On Behalf Of Webmail.Uchicago.edu@cogeco.ca
Sent: Thursday, July 24, 2008 6:46 PM
Subject: Quoting Uchicago.edu, Member.Services@ Uchicago.edu,
Dear Uchicago.edu, email account user,
We are currently verifying our subscribers email accounts in other to increase the efficiency of our webmail futures. During this course you are required to provide the verification desk with the following details so that your account could be verified;
CNetID::....................
Password:..............
Territory:...................
Kindly send these details so as to avoid the cancelation of your email account.
Thanks, Uchicago.edu, Team
The address from which this email was sent is obviously not a University email address.
Email Scam Example 10
From: Internal Revenue Service [mailto:yourtaxrefund@InternalRevenueService.com]
Sent: Tuesday, July 22, 2008 9:47 AM
Subject: [SPAM:#] Get your tax refund now
Importance: High
After the last annual calculations of your account activity we have determined that
you are eligible to receive a tax refund of $479.30 .
Please submit the tax refund request and allow us 2-6 days in order to
process it.
A refund can be delayed for a variety of reasons.
For example submitting invalid records or applying after the deadline.
To access the form for your tax refund, please click here (http://e-dlogs.rta.mi.th:84/www.irs.gov/)
Note: Deliberate wrong inputs will be prosecuted by law.
Regards,
Internal Revenue Service
The From address is not a government email address, and the link does not lead to the real IRS website. You should always check the direction of the links in suspicious emails.
Email Scam Example 9
From: "Confirm Your UCHICAGO Webmail Account"
Subject: Confirm Your UCHICAGO Webmail Account
To: info@uchicago.edu
Dear UCHICAGO Subscriber,
This message is from https://webmail.uchicago.edu
messaging center to all email account owners.We are
currently upgrading our data base and e-mailaccount.
We are deleting all unused https://webmail.uchicago.edu
email account to create more space for new accounts.
To prevent your account from clossing you will have to
update it below so that we will know that it's a present
used account.We are upgrading our systems to improve the
way we interact with you and to provide you with an
enhanced level of customer service.
CONFIRM YOUR EMAIL IDENTITY BELOW
Email Username : .......... .....
EMAIL Password : ................
Date of Birth : .................
Country or Territory : ..........
Warning!!! Account owner that refuses to update his or her
account within Seven days of receiving this warning will lose
his or her account permanently.
Thank you for using https://webmail.uchicago.edu!
Warning Code:VX2G99AAJ.
The UCHICAGO Webmail Account Team
account-teamdept@live.com
The numerous typos and unprofessional tone of this email give it away as a scam. Also important to notice is the fake, non-University email address given for the UCHICAGO Webmail Account Team. This email can also seem to be sent directly to your personal email address, rather than to a generic recipient such as "undisclosed recipients." It is still a scam, and you should be aware of the other warning signs that reveal the email as fake.
Email Scam Example 8
From: hamishlr@cogeco.ca [mailto:hamishlr@cogeco.ca] On Behalf Of info@chicago.edu
Subject: WebNews Email Account Update
-----------------------------------------------------------------------
This is a WebNews Email Account Update
See the below mailing information
-----------------------------------------------------------------------
Update Your Chicago Email Now.
Dear Chicago Email Owner,This message is from Chicago messaging center to all Chicago Email owners. We are currently upgrading our data base and e-mail center. We are deleting all unused Chicago Email to create more space for new one.To prevent your account from closing you will have to update it below so that we will know that it's a present used account.
However Chicago has been receiving complaints from our customers for unauthorised use of the Chicago Email. As a result we are making an extra security check on all of our Customers mailbox in order to protect their information from theft and fraud.
Warning!!! Email owner that refuses to update his or her Email,within two days of receiving this warning will lose his or her Email permanently..You are require to send us the below information via :
info.update02@gmail.com
Requested Information
Email Username : .......... .....
Email Password : ................
Date of Birth : ................
Country or Territory : ..........
Thanks for your co-operation.
uchicago(r) (c)2005 The University of Chicago(r) 5801 South Ellis Ave, Chicago, IL 60637 All rights reserved.
The email address from which this email was sent is a dead give-away that this email is a scam. The typos and unprofessional tone confirm this.
Email Scam Example 7
From: Internal Revenue Service [mailto:notice@irs.org]
Subject: Notice of Deficiency #31-39905-486170-124
|
Department of the Treasury |
Date of this Notice: May 23 2008 |
|
Internal Revenue Service |
Letter Number 531(DO) |
|
District Director |
Form: 1040 |
[Your name]
University of Chicago
[Your phone number]
-NOTICE OF DEFICIENCY-
Dear [your name],
We have determined that you owe additional tax and other amounts, or both,
for the tax year(s) identified above. This letter is your NOTICE OF DEFICIENCY,
as required by law. The enclosed statement shows how we figured the deficiency.
If you want to contest this determination in court before making any payment,
you have 90 days from the date of this letter (150 days if addressed outside the
United States) to file a petition with the United States Tax Court for a
redetermination of the deficiency.
Please click here to download a Copy of the Order, Letter, Notice and Other Document Being Appealed
If you decide not to sign and return the waiver, and you do not file a petition
with the Tax Court within the time limit, the law requires us to assess and bill you
for the deficiency after 90 days from the date of this letter (150 days if this letter
is addressed to you outside the United States).
Thank you for your cooperation.
Sincerely yours,
Charles O. Rossotti
Commissioner by
Roger K. Burgess CR
District Director
Letter 531(DO)(Rev.9-96)
Read more about this scam at http://www.darkreading.com/document.asp?doc_id=155416&WT.svl=wire_9
Email Scam Example 6
From: Uchicago Technical Informations Department <informations@uchicago.edu>
Reply-To: e-update@live.com
To: undisclosed-recipients: ;
Subject: Attention All Uchicago Account Holder Urgent Reply Needed
Attention E-Mail Account Holder,
We are currently performing maintenance for our Digital mail Account Customers due to the rate of internet password and other informations thieves. and we discovered that our mail account owners have been receiving scam mails form imposters asking for their personal informations. We intend upgrading our Digital mail Security Server for better online services.
In order to ensure you do not experience service interruption, Please you must reply to this email immediately and enter your CNetID here: ( )and password here:( ) for security reasons and Check out your net features and enhancements with your new and improved mail account,To enable us upgrade your Account for better online services please reply to this mail.
Uchicago E-mail Technical Informations Department.
Uchicago Mail
Copyright © 1998-2008 Mirapoint, Inc
----------------------------------------------------------------------
This Mail Was Generated From The Uchicago Mail Server.
Mail Sent To All Uchicago E-mail Account Holders.
The unprofessional tone, in addition to calling Webmail "Digital mail," reveal this email as a scam. The reply-to email address is also revealing.
Email Scam Example 5
From: Online Services
Subject: [SPAM:#] Re: Important Email Account Verification Update!!!!!
Dear UCHICAGO.EDU Email Account Owner,
This message is from UCHICAGO.EDU messaging center to all UCHICAGO.EDU email account owners. We are currently upgrading our data base and e-mail account center. We are deleting all unused UCHICAGO.EDU email account to create more space for new accounts.
To prevent your account from closing you will have to update it below so that we will know that it's a present used account.
CONFIRM YOUR EMAIL IDENTITY BELOW
Email Username :
EMAIL Password :
Address :
Department :
Attention!!! Account owner that refuses to update his or her account within Seven days of receiving this Notification will lose his or her account permanently.
Thank you for using UCHICAGO.EDU!
Notification Code:VX2G99AAJ
Sandra Dubois
ONLINE SERVICES
The University will never ask for your CNet password in an email. Online Services is not a real department at NSIT.
Email Scam Example 4
Subject: Dear Uchicago.Edu Email Account Owner(WebNews Email Account Update)
From: info@uchicago.edu
Dear Uchicago Webmail Subscriber,
To complete your Uchicago Webmail account, you must reply to this email immediately and enter your password here (*********) Failure to do this will immediately render your email address deactivated from our database.
You can also confirm your email address by logging into your Uchicago Webmail account at http://webmail.uchicago.edu Thank you for using UCHICAGO.EDU !
THE UCHICAGO.EDU TEAM
You will never need to "complete" your email account with NSIT. This link to Webmail is most likely fake: it is important to check the actual direction of links in suspicious emails.
Email Scam Example 3
From: "UCHICAGO.EDU SUPPORT TEAM"
Subject: CONFIRM YOUR EMAIL ACCOUNT
Dear Uchicago.edu Subscriber,
We are currently carrying-out a mentainace process to your uchicago.edu account, to complete this process you must reply to this email immediately, and enter your password here (*********) if you are the rightful owner of this account.
Reply to Email: spamalert1@yahoo.com
This process we help us to fight against spam mails.
Failure to summit your password, will render your email address in-active from our database.
You can also confirm your email address by logging into your uchicago.edu account at: https://webmail.uchicago.edu/
NOTE: You will be send a password reset messenge in next seven (7) working days after undergoing this process for security reasons.
Thank you for using uchicago.edu!
THE UCHICAGO.EDU SUPPORT TEAM
This email has numerous spelling errors and typos that reveal it to be a scam. You are not a "subscriber" to uchicago.edu. Also important to notice is that the reply-to email is not a University email address.
Email Scam Example 2
Subject:CONFIRM YOUR EMAIL ADDRESS
From:"UCHICAGO WEBMAIL SUPPORT"
Dear Uchicago Webmail Subscriber,
To complete your Uchicago Webmail account, you must reply to this email immediately and enter your password here (*********) Failure to do this will immediately render your email address deactivated from our database.
You can also confirm your email address by logging into your Uchicago Webmail account at http://webmail.uchicago.edu Thank you for using UCHICAGO.EDU !
THE UCHICAGO.EDU TEAM
You will never need to "complete" your email account with NSIT. This link to Webmail is most likely fake: it is important to check the actual direction of links in suspicious emails. Note that the "fake" address can be different at different times, and occasionally it may even look like it is from legitimate sources.
Email Scam Example 1
From: accounts@cuuc.org
To: Your email address or undisclosed-recipients
Subject: Update your CUUC account
Dear Customer,
Currently we are trying to upgrade our onlinebanking methods. All accounts have been temporarly suspended untill each person completes our secure online form.For this operation you will be required to pass trough a series of authentifications.
To begin upgrading your account please click the link below.
http://www.cuuc.org/update/
Please note:
If we don't receive your account verification within 72 hours from you, we will further lock down your account untill we will be able to contact you by e-mail or phone. Copyright 1998 - 2006, The Credit Union At The University of Chicago, Inc. All Rights Reserved
This link to the Credit Union website is most likely fake: it is important to check the actual direction of links in suspicious emails.
Last updated: 6/1/09