Phishing scams - Page 1
Forum section: electronics / general

author: MrMobodies
author_rank: Super Contributor
timestamp: October 02, 2024, 08:26:54 pm
content: I seem to be getting more of these type of scams and just got two emails today where they seem to use the Paypal and Outlook's platform as part of the scam where it passed the spam filter and was marked "trusted" with URL's that lead to Paypal.The URL behind the "Pay Now" button does have the Paypal domain in it followed by a long string so they have either setup an account or are using someone else's.Noticed in the to field: "noreply99@4maid.onmicrosoft.com" with no mentions of my email address anywhere or in the message source.QuoteObviously that phone number 888-884-9062 may lead to the scammer following the coercive behaviour.Yesterday I got one from "Batteryevo" where the domain spelt bateryevo (with one t) as discovered on mouse hover.The domain on that had been registered in about July.How many of these types of scams do you get and have you ever fallen for them?

author: ataradov
author_rank: Super Contributor
timestamp: October 02, 2024, 10:16:11 pm
content: Scammers were using PayPal like this to originate valid-looking messages for ages. People were trying to make PayPay do something about this, but they simply don't care.

author: Bryn
author_rank: Regular Contributor
timestamp: October 03, 2024, 08:37:50 am
content: Be careful when you open these kind of emails... it's a known fact that you will be swamped with more of them (if they contain tracking pixels that is, allowing the sender to know their emails have been opened and also know that the address sent to is active).I've received few of these emails in the past but I do not open them at all, for the reasons stated above (and I learnt this when I did cyber security).

author: JMK
author_rank: Contributor
timestamp: October 03, 2024, 10:02:25 am
content: I had an email from the telephone company, some time ago, asking for a bill to be paid. I knew payments were up to date so checked more carefully. Their email address finished with .corn instead of .com but otherwise looked legit.I now make a habit of cleaning my reading glasses before reading emails.

author: Halcyon
author_rank: Unknown
timestamp: October 03, 2024, 10:53:15 am
content: Quote from: JMK on October 03, 2024, 10:02:25 amI stand to be corrected, however I'm not award of a .CORN TLD. I don't think it exists. So I dare say that the email address was spoofed some other way.

author: madires
author_rank: Super Contributor
timestamp: October 03, 2024, 12:38:42 pm
content: Those emails are bait for the classic refund scam:- you call the number noted in the email (belongs to an Indian scam call center)- they want you to install some remote access tool on your computer/smartphone for the refund form- when filling out the form (shell or Google form) they add a few zeros to the amount- then they ask you to check your banking account online- screen is blacked out (pretending to be an OS update)- they modify the HTML in the browser to make you believe that you received a much too high refund amount- now they want you to return the difference (by sending notes in a box, buying giftcards and telling them the codes, ...)That's the basic scam script and it can come in many variations.

author: Bryn
author_rank: Regular Contributor
timestamp: October 03, 2024, 01:17:12 pm
content: Quote from: madires on October 03, 2024, 12:38:42 pmSeriously, how can these people even sleep at night? 😑Quote from: Halcyon on October 03, 2024, 10:53:15 amYes, ".corn" does not exist at all and is an obvious attempt at typosquatting.

author: TimFox
author_rank: Super Contributor
timestamp: October 03, 2024, 01:34:33 pm
content: For malicious typography, also beware of the use of Cyrillic or Greek letters that resemble letters in the Latin alphabet, but have different Unicode values, to counterfeit legitimate domains.

author: ataradov
author_rank: Super Contributor
timestamp: October 03, 2024, 01:38:07 pm
content: Quote from: Bryn on October 03, 2024, 08:37:50 amNo modern email client loads images or any other outside resources in emails not from your contacts.But those are coming from PayPal, scammers have no access to anything. They are just regular payment requests with description field designed to make you call them.

author: Haenk
author_rank: Super Contributor
timestamp: October 04, 2024, 11:38:42 am
content: Those PayPal emails are just like scam (paper) invoices, that's a decade old business. (Now in it's digital form somewhat cheaper to run, as there is no postage required, but I assume even smaller success rate, as PayPal will ban those accounts quickly...)Btw. I highly recommend Thunderbird as a mail client. This already disables external content by default (in former times, this was optional), making look-alike emails way harder to fool you.

author: JMK
author_rank: Contributor
timestamp: October 04, 2024, 12:01:44 pm
content: Quote from: Halcyon on October 03, 2024, 10:53:15 amProbably.I seriously looked at the email. At the top I noticed .corn, then thought to myself "those cunning mongrels, someone is bound to click somewhere they shouldn't"; then promptly pressed delete. I didn't bother wasting my time playing detective to find what else was available to click in the email.