Safe Computing
The Phish Pharm: Examples of email scams
Email Scam Example 14
From: kb0011@optimum.net [mailto:kb0011@optimum.net]
Sent: Tuesday, August 12, 2008 11:01 AM
Subject: Dear Account User Student webmail
Dear Account User Student webmail,
This message is from school webmail,messaging center to all student account owners. We are currently upgrading our data base and e-mail account center. We are deleting all unused school Email,account to create more space for new accounts.
To prevent your Account from closing you will have to update it by providing
the information requested below:
Confirm Your Account Details
----------------------------
Webmail ID:
Password:
D.O.B:
---------------------------------------
You will be sent a new confirmation alphanumerical password so that it
will only be valid during this period and can be changed after the
process.Thanks for your understanding.
School Administrator Problem.
Warning!!! Account owner that refuses to update his or her account within seven days of receiving this warning will lose his or her account permanently
Not only is this email not sent from a University of Chicago email address, the obvious typos and poor attempt at approximating "professional" email style mark this as a scam.
Email Scam Example 13
From: Webmail Upgrading Service [mailto:upgradinservice@info.com]
Sent: Monday, August 25, 2008 7:10 AM
Subject: [SPAM:#] Webmail Upgrading Service
Dear Subscriber,
Due to spam complaints of email users in our webmail system, our investigation shows that your email address is compromised and is used to send out spam message in our webmail system.
As a result, our network engineer will be conducting a maintenance in our webmail system, your Username will be disabled if you do not send us the required information within 48hrs.
Informations Required:
Your Full Names:
Email address:
Password:
Retype Password:
E-mail: account-teamdept@live.com
We value your business and thanks for using our Webmail Service.
Maintenance Webmail Team.
Though this email could be convincing because of the lack of obvious typos and the use of Webmail, it is important to notice that it was not sent from a University of Chicago email address and contains no mention of the University.
Email Scam Example 12
From: jk4km@cogeco.ca [mailto:jk4km@cogeco.ca] On Behalf Of Uchicago
Sent: Tuesday, August 19, 2008 8:38 AM
Subject: [Chicago Card] Dear Uchicago.Edu.User
Dear Uchicago.Edu.User.
This mail is to notify all users that the site will be undergoing upgrade in a couple of days from now.
Hence, as a user of Uchicago.edu, you are required to send us your email account details to enable us acknowledge
account activeness Furthermore, be informed that we will be deleting all mail account that is not active so as to create
more space for new users.
Therefore you are advice to send us your mail account details As requested below
*User name:.........
*Password:..............
*Date of birth:................
*Security question:.............
*Security answer:.....................
All users (Uchicago.edu) are advise to complete this update.
Regards
Mark Anderson
Tech/Maintenance officer
The address from which this email was sent is obviously not a University email address. The numerous typos and unprofessional tone of this email also give it away as a scam.
Email Scam Example 11
From: avoth@cogeco.ca [mailto:avoth@cogeco.ca] On Behalf Of Webmail.Uchicago.edu@cogeco.ca
Sent: Thursday, July 24, 2008 6:46 PM
Subject: Quoting Uchicago.edu, Member.Services@ Uchicago.edu,
Dear Uchicago.edu, email account user,
We are currently verifying our subscribers email accounts in other to increase the efficiency of our webmail futures. During this course you are required to provide the verification desk with the following details so that your account could be verified;
CNetID::....................
Password:..............
Territory:...................
Kindly send these details so as to avoid the cancelation of your email account.
Thanks, Uchicago.edu, Team
The address from which this email was sent is obviously not a University email address.
Email Scam Example 10
From: Internal Revenue Service [mailto:yourtaxrefund@InternalRevenueService.com]
Sent: Tuesday, July 22, 2008 9:47 AM
Subject: [SPAM:#] Get your tax refund now
Importance: High
After the last annual calculations of your account activity we have determined that
you are eligible to receive a tax refund of $479.30 .
Please submit the tax refund request and allow us 2-6 days in order to
process it.
A refund can be delayed for a variety of reasons.
For example submitting invalid records or applying after the deadline.
To access the form for your tax refund, please click here (http://e-dlogs.rta.mi.th:84/www.irs.gov/)
Note: Deliberate wrong inputs will be prosecuted by law.
Regards,
Internal Revenue Service
The From address is not a government email address, and the link does not lead to the real IRS website. You should always check the direction of the links in suspicious emails.
Email Scam Example 9
From: "Confirm Your UCHICAGO Webmail Account"
Subject: Confirm Your UCHICAGO Webmail Account
To: info@uchicago.edu
Dear UCHICAGO Subscriber,
This message is from https://webmail.uchicago.edu
messaging center to all email account owners.We are
currently upgrading our data base and e-mailaccount.
We are deleting all unused https://webmail.uchicago.edu
email account to create more space for new accounts.
To prevent your account from clossing you will have to
update it below so that we will know that it's a present
used account.We are upgrading our systems to improve the
way we interact with you and to provide you with an
enhanced level of customer service.
CONFIRM YOUR EMAIL IDENTITY BELOW
Email Username : .......... .....
EMAIL Password : ................
Date of Birth : .................
Country or Territory : ..........
Warning!!! Account owner that refuses to update his or her
account within Seven days of receiving this warning will lose
his or her account permanently.
Thank you for using https://webmail.uchicago.edu!
Warning Code:VX2G99AAJ.
The UCHICAGO Webmail Account Team
account-teamdept@live.com
The numerous typos and unprofessional tone of this email give it away as a scam. Also important to notice is the fake, non-University email address given for the UCHICAGO Webmail Account Team.
Email Scam Example 8
From: hamishlr@cogeco.ca [mailto:hamishlr@cogeco.ca] On Behalf Of info@chicago.edu
Subject: WebNews Email Account Update
-----------------------------------------------------------------------
This is a WebNews Email Account Update
See the below mailing information
-----------------------------------------------------------------------
Update Your Chicago Email Now.
Dear Chicago Email Owner,This message is from Chicago messaging center to all Chicago Email owners. We are currently upgrading our data base and e-mail center. We are deleting all unused Chicago Email to create more space for new one.To prevent your account from closing you will have to update it below so that we will know that it's a present used account.
However Chicago has been receiving complaints from our customers for unauthorised use of the Chicago Email. As a result we are making an extra security check on all of our Customers mailbox in order to protect their information from theft and fraud.
Warning!!! Email owner that refuses to update his or her Email,within two days of receiving this warning will lose his or her Email permanently..You are require to send us the below information via :
info.update02@gmail.com
Requested Information
Email Username : .......... .....
Email Password : ................
Date of Birth : ................
Country or Territory : ..........
Thanks for your co-operation.
uchicago(r) (c)2005 The University of Chicago(r) 5801 South Ellis Ave, Chicago, IL 60637 All rights reserved.
The email address from which this email was sent is a dead give-away that this email is a scam. The typos and unprofessional tone confirm this.
Email Scam Example 7
From: Internal Revenue Service [mailto:notice@irs.org]
Subject: Notice of Deficiency #31-39905-486170-124
|
Department of the Treasury |
Date of this Notice: May 23 2008 |
|
Internal Revenue Service |
Letter Number 531(DO) |
|
District Director |
Form: 1040 |
[Your name]
University of Chicago
[Your phone number]
-NOTICE OF DEFICIENCY-
Dear [your name],
We have determined that you owe additional tax and other amounts, or both,
for the tax year(s) identified above. This letter is your NOTICE OF DEFICIENCY,
as required by law. The enclosed statement shows how we figured the deficiency.
If you want to contest this determination in court before making any payment,
you have 90 days from the date of this letter (150 days if addressed outside the
United States) to file a petition with the United States Tax Court for a
redetermination of the deficiency.
Please click here to download a Copy of the Order, Letter, Notice and Other Document Being Appealed
If you decide not to sign and return the waiver, and you do not file a petition
with the Tax Court within the time limit, the law requires us to assess and bill you
for the deficiency after 90 days from the date of this letter (150 days if this letter
is addressed to you outside the United States).
Thank you for your cooperation.
Sincerely yours,
Charles O. Rossotti
Commissioner by
Roger K. Burgess CR
District Director
Letter 531(DO)(Rev.9-96)
Read more about this scam at http://www.darkreading.com/document.asp?doc_id=155416&WT.svl=wire_9
Email Scam Example 6
From: Uchicago Technical Informations Department <informations@uchicago.edu>
Reply-To: e-update@live.com
To: undisclosed-recipients: ;
Subject: Attention All Uchicago Account Holder Urgent Reply Needed
Attention E-Mail Account Holder,
We are currently performing maintenance for our Digital mail Account Customers due to the rate of internet password and other informations thieves. and we discovered that our mail account owners have been receiving scam mails form imposters asking for their personal informations. We intend upgrading our Digital mail Security Server for better online services.
In order to ensure you do not experience service interruption, Please you must reply to this email immediately and enter your CNetID here: ( )and password here:( ) for security reasons and Check out your net features and enhancements with your new and improved mail account,To enable us upgrade your Account for better online services please reply to this mail.
Uchicago E-mail Technical Informations Department.
Uchicago Mail
Copyright © 1998-2008 Mirapoint, Inc
----------------------------------------------------------------------
This Mail Was Generated From The Uchicago Mail Server.
Mail Sent To All Uchicago E-mail Account Holders.
The unprofessional tone, in addition to calling Webmail "Digital mail," reveal this email as a scam. The reply-to email address is also revealing.
Email Scam Example 5
From: Online Services
Subject: [SPAM:#] Re: Important Email Account Verification Update!!!!!
Dear UCHICAGO.EDU Email Account Owner,
This message is from UCHICAGO.EDU messaging center to all UCHICAGO.EDU email account owners. We are currently upgrading our data base and e-mail account center. We are deleting all unused UCHICAGO.EDU email account to create more space for new accounts.
To prevent your account from closing you will have to update it below so that we will know that it's a present used account.
CONFIRM YOUR EMAIL IDENTITY BELOW
Email Username :
EMAIL Password :
Address :
Department :
Attention!!! Account owner that refuses to update his or her account within Seven days of receiving this Notification will lose his or her account permanently.
Thank you for using UCHICAGO.EDU!
Notification Code:VX2G99AAJ
Sandra Dubois
ONLINE SERVICES
The University will never ask for your CNet password in an email. Online Services is not a real department at NSIT.
Email Scam Example 4
Subject: Dear Uchicago.Edu Email Account Owner(WebNews Email Account Update)
From: info@uchicago.edu
Dear Uchicago Webmail Subscriber,
To complete your Uchicago Webmail account, you must reply to this email immediately and enter your password here (*********) Failure to do this will immediately render your email address deactivated from our database.
You can also confirm your email address by logging into your Uchicago Webmail account at http://webmail.uchicago.edu Thank you for using UCHICAGO.EDU !
THE UCHICAGO.EDU TEAM
You will never need to "complete" your email account with NSIT. This link to Webmail is most likely fake: it is important to check the actual direction of links in suspicious emails.
Email Scam Example 3
From: "UCHICAGO.EDU SUPPORT TEAM"
Subject: CONFIRM YOUR EMAIL ACCOUNT
Dear Uchicago.edu Subscriber,
We are currently carrying-out a mentainace process to your uchicago.edu account, to complete this process you must reply to this email immediately, and enter your password here (*********) if you are the rightful owner of this account.
Reply to Email: spamalert1@yahoo.com
This process we help us to fight against spam mails.
Failure to summit your password, will render your email address in-active from our database.
You can also confirm your email address by logging into your uchicago.edu account at: https://webmail.uchicago.edu/
NOTE: You will be send a password reset messenge in next seven (7) working days after undergoing this process for security reasons.
Thank you for using uchicago.edu!
THE UCHICAGO.EDU SUPPORT TEAM
This email has numerous spelling errors and typos that reveal it to be a scam. You are not a "subscriber" to uchicago.edu. Also important to notice is that the reply-to email is not a University email address.
Email Scam Example 2
Subject:CONFIRM YOUR EMAIL ADDRESS
From:"UCHICAGO WEBMAIL SUPPORT"
Dear Uchicago Webmail Subscriber,
To complete your Uchicago Webmail account, you must reply to this email immediately and enter your password here (*********) Failure to do this will immediately render your email address deactivated from our database.
You can also confirm your email address by logging into your Uchicago Webmail account at http://webmail.uchicago.edu Thank you for using UCHICAGO.EDU !
THE UCHICAGO.EDU TEAM
You will never need to "complete" your email account with NSIT. This link to Webmail is most likely fake: it is important to check the actual direction of links in suspicious emails. Note that the "fake" address can be different at different times, and occasionally it may even look like it is from legitimate sources.
Email Scam Example 1
From: accounts@cuuc.org
To: Your email address or undisclosed-recipients
Subject: Update your CUUC account
Dear Customer,
Currently we are trying to upgrade our onlinebanking methods. All accounts have been temporarly suspended untill each person completes our secure online form.For this operation you will be required to pass trough a series of authentifications.
To begin upgrading your account please click the link below.
http://www.cuuc.org/update/
Please note:
If we don't receive your account verification within 72 hours from you, we will further lock down your account untill we will be able to contact you by e-mail or phone. Copyright 1998 - 2006, The Credit Union At The University of Chicago, Inc. All Rights Reserved
This link to the Credit Union website is most likely fake: it is important to check the actual direction of links in suspicious emails.
Last updated: 8/26/08