December 26, 2018

[hr_invisible]

Phish NETS: Bank of America

The only phish found swimming in last week’s sea was sent to us by a TDS reader.  This email claims to represent Bank of America. Though we could not verify where the link “Online Banking” pointed to, it is CRYSTAL CLEAR that this is a phishing email if you simply read the email itself and look at the FROM address.  Thank goodness for bad English.

[hr_invisible]

[hr_invisible]

YOUR MONEY: GTRacing Gaming Office Chair and Canada Goose Coats

Read these wonderful advertisements and think of the old adage “if it seems too good to be true, it is.”  This first Ad also comes to us through a Reddit.com user. It seems he found this fantastic online deal on December 21st, just before Christmas for a “GTRacing Gaming Office Chair.”  It normally sells for about $300 but this remarkable sale puts that price at 80% off. (“80% Off” seems to be the magical percent off in every single malicious clickbait advertisement we’ve ever seen in the last few years, without exception!)

Note how this advertisement contains language meant to pressure you into making a decision quickly….

• Sale ends Dec. 22 (tomorrow)
• Hurry Only 4 Left!

…as well as content that is meant for you to feel that this is legitimate and valued by others…

• 93% of our customers have enjoyed their order. 1530 Orders.
• Guaranteed Safe Checkout from 7 known services (None of which are true! They’ve just stolen and misused the graphics!))
• Free Worldwide Shipping! (Seriously???  If this were real, it would cost more to ship this chair than the price of the chair!)

This oddball domain, dualsmok[.]com, was registered through an anonymous proxy service just 13 days before the Reddit user found this ad.  We know from long experience that a newly registered domain is never a good sign of legitimacy!  And one final note, according to the Reddit user, the “ABOUT” web page states, “Here at Dualsmpl, we understand that each gamer has different preferences which is why we value having choices.” They don’t even spell their own business name correctly!  A big, fat delete!

Speaking of 80% off, we received this advertisement for Canada Goose down jackets, except that the email didn’t come from CanadaGoose.com, or other recognizable establishments.  The email came from the crap domain uqdkh[.]com and all links in this email point to another crap domain, uqbuy[.]top.  This second domain was registered to Nexperian Holding Company Limited of Hangzhou, China.  We’ve written about Nexperian’s shady business offers seven times, starting in February, 2018. (Read the Feb. 7 Your Money column.)

[hr_invisible]

[hr_invisible]

TOP STORY: PayPal Instant Payment to You

Quite honestly, we’re not entirely certain how this next scam was meant to unfold.  But we are 100% certain that this is a scam and the TDS reader who sent us this information was at risk of losing money to criminals who are likely based in Africa or at risk for doing something illegal on their behalf.

This story begins and ends with an “official” lengthy email that appears to be from PayPal about an “instant payment of $750.00 USD from Michael Salgado.”  Apparently, the recipient was asked to ship an item to an address in Aflao, Ghana for which she was to be paid the large sum of money. Suspicions first arose because no payment of any amount appeared in the recipient’s PayPal account, though the email clearly says that an “instant payment” was made to her account.  This caused the recipient to look more closely at the details of this email and contact us. Here are the red flags that jumped out at us…

1. The email says “From: PayPal” but the domain that follows the “@” symbol is not paypal.com.  It is ukaccountant[.]net. TDS learned that ukaccountant[.]net is a free email service available in the UK.  ScamWarners.com has noted many instances that this domain has been used by criminals in fraudulent emails such as this example pretending to be from Lloyds Bank of London.
2. The email below states in bold that the recipient should not reply to this email but instead, click the link to contact the PayPal representative named “Agent Diana Hentges.”  However, mousing-over that link for Agent Hentges shows that it pointed to a Gmail account, not an employee account with paypal.com.
3. The email below contains a table with information about the expected transaction.  The bottom row of this table contains a link under “Status” and another under “Details.”  The first link simply points to “www.paypal.com” and not to any particular account or transaction.  The second is simply a link to send “Agent Hentges” an email. So essentially, these links contain no details or information about this transaction at all or the accounts involved.

The red flags raised in this email are proof that it is fraudulent and the sender doesn’t represent the real PayPal.com business.  So we wondered what’s the scam here? Though we are not certain, PayPal itself has detailed many scams that target PayPal users in an article titled “What Are Common Scams and How Do I Spot Them.”  If you visit this PayPal page and scroll down about ⅔ of the way you’ll see several “Shipping Scams.”  We believe this email represents one of these shipping scams.

TDS has recently seen a number of shipping scams reported to us during the last three months, compared with none in the last three years!  In one conversation with a TDS reader in early December, the victim had been hired to re-ship packages for an “agent” and was paid for his time.  He stopped after the third box when he realized that it was highly likely that he was shipping stolen goods overseas.