Another phishing email

I received a very "professional" email last night from ebilling @ bt.com which contained the BT logo (proper size), my account number asterisked in the usual way, my name, and said :
"We've put your latest BT bill online for you to view.
View your bill now (which was a link)
When you are logged into your account, you can check your recent usage ...... etc etc
Regards
BT.com
This is an automatic email etc etc
British Telecommunications plc etc etc"
No bill was actually due, this wasn't one of the usual prompts you get from BT online services.  Foolishly, I clicked on the link to check it out and it took me to the genuine BT website where I logged in and it did display all my old bill details, and what you'd normally find.  It was the BT https site as far as I could see.
So I believed it genuine - but I noticed the email appeared to contain an attachment, and BT say they never send attachments.  I didn't click on the attachment.
In the light of that, I reported it to BT as a potential phishing scam, and deleted the email (after printing it)
Someone has just phoned me just now, Indian call centre it seemed, and told me it was a scam.  In the conversation, I was asked to confirm my details, as one is usually asked.  The call from from 08003289393 which is said to be a generic BT number, but I believe isn't secure.
Has anyone else had this email?  WAS it a phishing email?  If so, it was totally believable.
I've run a full system scam and no malware has been picked up.  I've changed my BT password.  Anything else I should do?
All advice gratefully received!

Ostrich wrote:
I received a very "professional" email last night from ebilling @ bt.com which contained the BT logo (proper size), my account number asterisked in the usual way, my name, and said :
"We've put your latest BT bill online for you to view.
View your bill now (which was a link)
When you are logged into your account, you can check your recent usage ...... etc etc
Regards
BT.com
This is an automatic email etc etc
British Telecommunications plc etc etc"
No bill was actually due, this wasn't one of the usual prompts you get from BT online services.  Foolishly, I clicked on the link to check it out and it took me to the genuine BT website where I logged in and it did display all my old bill details, and what you'd normally find.  It was the BT https site as far as I could see.
So I believed it genuine - but I noticed the email appeared to contain an attachment, and BT say they never send attachments.  I didn't click on the attachment.
In the light of that, I reported it to BT as a potential phishing scam, and deleted the email (after printing it)
Someone has just phoned me just now, Indian call centre it seemed, and told me it was a scam.  In the conversation, I was asked to confirm my details, as one is usually asked.  The call from from 08003289393 which is said to be a generic BT number, but I believe isn't secure.
Hi.
What are you using as an email viewer ? Is it webmail or something like Outlook Express or Thunderbird ?
Chances are the attachment could be something like a picture link, rather than a dodgy file attachment.
Also the fact that it was a https is also pretty good. You don't say what the link was ....
The 0800 number is a BT number when they call you. If you dial it, then it says that BT called and nothing else is needed. There is no particular problem with that after you reported the probable phish.
However as you say your bill isn't due, then the email does seem somewhat suspect. If you still had the email, I'd ask you to provide the email headers (removing any personal info) - that is the way to tell for sure (as well as the almost certain dodgy html link)
http://www.andyweb.co.uk/shortcuts
http://www.andyweb.co.uk/pictures

Similar Messages

  • What to do about Phishing emails

    As like most people I am getting fed up with Phishing emails pretending to come from BT etc etc and have no real idea if anyone is trying to do anything about it i have started to do something myself.
    On some of them particularly those with "Buttons" you can see the routing to where the Trojan programme etc is located.
    I now email the owner of the site either by any contact information given or by looking it up on "Whois" if it is shown as a numeric.
    I then send them a polite message saying that it looks as though there site has been hacked and they are hosting a programme that is used for Phishing.
    So far i have sent 10 and got 8 replies 4 said they have removed the link and the associated account 4 said that they have left the link but advised the local police regarding the fraud.
    So far i have had replies from the Phillapines, China and Malaya.
    I have no illusions that this will stop it but it might dent it more than seems to be dane by anyone else.

    Like you, I'm more than cheesed off with daily, false, "BT" emails but there is another issue, which so far I can't see anybody has raised i.e....... probably like everyone else I've sent countless copies of fakes to "Phishing" and to "Abuse" at BT only to receive the same pointless standard answers, with no action, from BT.
    It is just not good enough for BT to fob off these complaints from many, many people, by saying that they (BT) can only do something if fake emails come from BT source / customer ..... these fake emails are leading unsuspecting people to believe that they are genuine and in any other (business) circumstance, this could be treated as fraud or misrepresentation, and could be actioned on by law enforcement / Trading Standards.
    Does BT not care that their Logos / Headings / personnel are all clearly being massively misrepresented, day after day to countless numbers of their clients, all with an end view to illegal activity being carried out by the sender ??????
    How much longer before senior personnel get off their rear ends and do something, instead of cowering behind their standard replies and paying lip service only to this problem, a problem which has existed for years, and is now increasing due to BT changes, and to get their vast resources to take action on this criminal activity, which we, as high cost paying customers, are expected to endure ???

  • Mail sending phishing email?

    ClamXav sentry is reporting I am sending phishing email. Nothing appears in Sent messages but the offending file can be tracked down and moved to trash. If I do this,  another is sent. Scanning the Mac with ClamXav doesn't provide any clues as to what's generating the emails, so I'm at a loss as to how to stop this.

    whyamihavingproblems wrote:
    ClamXav sentry is reporting I am sending phishing email. Nothing appears in Sent messages but the offending file can be tracked down and moved to trash. If I do this,  another is sent. Scanning the Mac with ClamXav doesn't provide any clues as to what's generating the emails, so I'm at a loss as to how to stop this.
    I don't know whether this will solve your problem or not, but you must never move email manuallly, either to the trash or to a quarantine folder. Don't allow any AV software to do so. Moving will surely corrupt the mailbox index which could result in lose of additional emails. More improtantly, the offending email won't be deleted from the email server if you use IMAP or POP3 leaving messages on the server. The next time you check for new email that same message will be downloaded to your computer.
    The only way an email should be deleted is by opening it with your email client and using the delete feature there. With ClamXav you can do this by either finding the path in your scan log or by a right-click/control-click on the file name and choosing "Reveal In Finder". When the window opens, double click on the email to open it in your email client. If you agree that it is infected delete it there and empty the trash folder. If you disagree, make note of the file name (usually <number>.eml or .emlx) so you can ignore it the next time you scan.
    One additional step is necessary with gmail accounts. You must use webmail in your browser to permanently delete any files.
    Hope this helps.

  • SKY Phishing emails received 01/03/15 not from SKY re; Account Update / changing settings

    I have received TWO emails this evening purporting to be from SKY asking me to update my details before I lose my Sky email address. The link takes you to a phishing site that looks like a SKY login screen but isn't !! I have reported the emails to both SKY and Google but there will be a number of people caught out by this before the site is taken down. PLEASE BE AWARE of this !!

    I received an identical email today as below, which I forwarded to [email protected] "Hello My email address)The Classic version of your layout will be replaced by our new version on 26th JUNE 2015. So it's time to upgrade, before you lose your email access.
    When you upgrade your E-mail
    Your service won't be affected and you'll keep all your old contacts, folders and messages. Plus you'll get:Faster E-mailThe latest spam protectionUnlimited E-mail storageHow you can upgrade your account
    sky.com/en-GB/update/layout/ (It gave this link but with http etc at the beginning)
     Thanks for choosing us" Scam and Phishing emails that infect your computers wil often fail to address you by name and use the term Hello as this one does. It is also worth clicking on reply so that you can see who has sent the email. In this case it was shown as coming from [email protected] I also contacted SKY who confirmed that they had not sent me any emails today. I have marked it on my SKY webmail as spam so that if I receive another one then it will go straight into my Spam folder. Please be wary of these scammers.

  • ClamXav detecting phishing email (can't get rid of them)

    I received an email from my wife that she did not send me. It was an email that made no sense. It just had a bunch of words in a very long document. I assumed that her email program (Mac Mail) must have become infected with something that sent this email out to everyone in her address book. I deleted the email and downloaded ClamXav to check my system and make sure everything is ok.
    Whenever I run ClamXav, it detects 8 files with the following infection name: (Heuristics.Phishing.Email.SpoofedDomain)
    I ask ClamXav to quarantine the files, then I go into that folder and delete them. But if I run a check later, those 8 files are back. I can't get rid of them.
    I'm wondering if they are reinfecting my Mac Mail program via Apple's mail servers. I'm not sure if all my mail messages are kept on Apple's server, and them somehow these malware files get re-downloaded to my computer. I tried to figure out if there is a setting in my mail program that allows me to uncheck a box that says, "save mail files on server".....but I can't find any such setting. I thought I remember seeing something like that in the past.
    Does anyone have any idea what is causing my computer to be continuously reinfected and what I should do about it? I don't notice any problems with my computer, but obviously these files that I can't permanently delete has me worried.

    Randall Olson1 wrote:
    Whenever I run ClamXav, it detects 8 files with the following infection name: (Heuristics.Phishing.Email.SpoofedDomain)
    I ask ClamXav to quarantine the files, then I go into that folder and delete them. But if I run a check later, those 8 files are back. I can't get rid of them.
    First, I would encourage you to come to the ClamXav Forum to more quickly and efficiently answer questions such as this.
    My standard guidance for handling reported e-mail infection is as follows (pay particular attention to #6):
    Never use ClamXav (or any other A-V software) to move (quarantine) or delete e-mail. It will corrupt the mailbox index which could cause loss of other e-mail and other issues with functions such as searching. It may also leave the original e-mail on your ISP's e-mail server and will be re-downloaded to your hard drive the next time you check for new mail.
    So, if you choose to "Scan e-mail content for malware and phishing" in the General Preferences, make sure you do not elect to either Quarantine or Delete infected files.
    When possibly infected e-mail files are found:
    Right-click/Control-click on either the infection or file name in the ClamXav window.
    Select "Reveal In Finder" from the pop-up menu.
    When the window opens, double-click on the file to open the message in your e-mail client application.
    Read the message and if you agree that it is junk/spam/phishing then use the e-mail client's delete button to delete it (this is especially important when the word "Heuristics" appears in the infection name).
    If you disagree and choose to retain the message, return to ClamXav and choose "Exclude From Future Scans" from the pop-up menu.
    If this is a g-mail account and those messages continue to show up after you have deleted them in the above manner, you may need to log in to webmail using your browser, go to the "All Mail" folder, find the message(s) and use the delete button there to permanently delete them from the server.
    To fix corrupted mailbox index(es), highlight each one that was corrupted and choose Rebuild from the appropriate menu.

  • I lost my ipad, and when i logged in to my apple account, i found another person email. what can i do to trace ? my ipad hasnt been registered with apple before i lost it, can i registered now (as i still have the package) and then supply the serial no.

    Hi, just wonder anyone can help. i lost my ipad few weeks ago (already reported to police in UK but they arent helpful), and when i logged in to my apple account, i found another person email added to my apple account (but has not been verified). what can i do to trace ? my ipad hasnt been registered with apple before i lost it, can i registered now (as i still have the package) and then supply the serial no. to apple so they can block that ipad??
    i am based in london, but seems now the apple account based in USA.. very strange.
    i am using iphone as well, so beforei lost the ipad, when i download apps, it download to both iphone and ipad.
    i am not sure what i can do to make apple aware of the lost ipad, as i havent registered my ipad before i lost it. or can i registered now and report a lost??
    appreciate any advice..
    thanks

    The only tracking feature Apple offers is the one tied to your iCloud account (https://www.apple.com/icloud/features/find-my-iphone.html).  If you did not have an iCloud account set up on the iPad, or did not have the "find my iPad" setting enabled under that account's settings, then you cannot track it remotely.
    There is nothing you can do but hope the police do something, or you find it yourself.  Apple does not get involved with lost or stolen property.
    see http://support.apple.com/kb/HT2526
    However, I hope you IMMEDIATELY changed your AppleID password when you noticed the added email - the only way someone could do that is if they know both your AppleID primary email address AND your current password.

  • Where do I send a phishing email claiming to be from Adobe?

    I read to report any suspicious emails to customer support but I don't see an email address to send the email I received as follows...
    Subject: Scan de 4155008
    > Date: Tue, 1 Jul 2014 15:20:43 +0100
    > From: [email protected]
    > To: [email protected]
    > Subject: Scan de 4155008
    >
    > Scan de 4155008
    > Format de fichier: PDF MMR(G4)
    > Resolution: 200dpi x 200dpi
    >
    > Le fichier joint est une image numerisee au format PDF. Utilisez Acrobat(R)Reader(R) ou Adobe(R)Reader(R) d'Adobe
    > Systems Incorporated pour visualiser le document. Il est possible de telecharger Adobe(R)Reader(R) de l'adresse suivante:
    > Adobe, le logo Adobe, Acrobat, le logo Adobe PDF et Reader sont des marques deposees ou des marques commerciales
    > d'Adobe Systems Incorporated aux Etas-Unis et dans les autres pays. http://www.adobe.com/
    Although the email address is not mine I want to report it to be investigated. There's an attachment but I'm not opening it, it's a zipped folder. Thank you for your time and help.

    I think you are right to be suspicious of this email. There is every chance that the attachment is infected and you should not open it.
    However
    1. It does not seem to be a Phishing email at all. There is no invitation to login, to send personal details, or to do anything else related to phishing.
    2. The email does not say it is from Adobe, or in any way connected with Adobe. It does not impersonate Adobe email addresses, it uses hotmail addresses. It just says there is a PDF, and has typical text about how to get Adobe Reader.
    Not sure why you think Adobe would be interested in this.

  • I believe I opened a link to a phishing email.

    I believe I opened a link to a phishing email. After opening, it took me to some bogus webpage and I quickly closed out of it and deleted the email. I didn't enter any information onto the webpage. Am I in any danger of identity theft? If so, what should I do?

    No, since you did not enter any information into the web page.
    For future reference, if you are thinking of clicking on a link in an email, hover over it for a moment first. This will show you what it actually links to. If it does not match where you expect to go, do not use it. Better yet, always type in URLs in your web browser.
    Example - in an email it might look like www.wellsfargo.com but hovering over it might show www.istealyourlogin.info.
    Best of luck.

  • I received a phishing email supposedly from my bank and clicked on url - didn't enter any data though.Bank says to get ipad checked for viruses,but I understood ipad has built in security.I've cleared cookies in safari via settings.  Anything else to do?

    I received a phishing email supposedly from my bank and clicked on url - didn't enter any data though.Bank says to get ipad checked for viruses,but I understood ipad has built in security.I've cleared cookies in safari via settings.  Anything else to do?

    I know this has been solved as you reported, but I think you need to check with your e-mail provider. Did you also get this same e-mail on your computer? If you use the same ID for e-mail on computer and ipad, it should have appeared on both. It's very common spam. Check your computer to see if on it, the e-mail is in spam, or, if you deleted it on your ipad, check your recently deleted e-mails.
    You might want to consider changing your password, though people sending spam, don't need it. My e-mail provider had me change my password, not because I was getting spam, but unknown to me, I was sending it!  (You'll still get some spam, though.) It's when you learn that you're unknowingly sending spam...that you must change your password.
    Hope this helps.
    (Ss I was sending this, I just got an e-mail notification from the Nigerian... it got to my e-mail instead of going to spam.)

  • I received a phishing email from what I thought was my bank.  Do I need to do anything to my MAC for security?

    I received a phishing email from what I thought was my bank.  Do I need to do anything to my MAC for security? I have no anti-virus software.

    Evelyn, there is nothing that can prevent you or anyone from falling victim to those attempts to defraud you – other than you.
    "Phishing" scams are the most common way of getting people to voluntarily supply information that should be kept as secure as any other personal possession. "Anti-virus" solutions can't possibly prevent that sort of fraud, and if anything can only lull you into falsely believing you're being protected from threats, be they real or perceived.
    Do you have any further advice so that I don't fear my Mac?
    There is no reason to fear your Mac; it's a tool to be used for your sole benefit. Like any tool though, it can be misused. If there is any explanation for fear, it's a lack of education. Knowledge conquers fear and renders it inert. Learn what real threats actually exist, how to defend yourself from them, and how to distinguish them from those propagated by fear mongering psychopaths that justify their existence by keeping others misinformed. There are an abundance of the latter.
    There will always be threats to your information security associated with using any Internet - connected communications tool:
    You can mitigate those threats by following commonsense practices
    Delegating that responsibility to software is an ineffective defense
    Assuming that any product will protect you from those threats is a hazardous attitude that is likely to result in neglecting point #1 above.
    OS X already includes everything it needs to protect itself from viruses and malware. Keep it that way with software updates from Apple.
    A much better question is "how should I protect my Mac":
    Never install any product that claims to "clean up", "speed up",  "optimize", "boost" or "accelerate" your Mac; to "wash" it, "tune" it, or to make it "shiny". Those claims are absurd.Such products are very aggressively marketed. They are all scams.
    Never install pirated or "cracked" software, software obtained from dubious websites, or other questionable sources.
    Illegally obtained software is almost certain to contain malware.
    "Questionable sources" include but are not limited to spontaneously appearing web pages or popups, download hosting sites such as C net dot com, Softonic dot com, Soft pedia dot com, Download dot com, Mac Update dot com, or any other site whose revenue is primarily derived from junk product advertisements
    If you need to install software that isn't available from the Mac App Store, obtain it only from legitimate sources authorized by the software's developer.
    Don’t supply your password in response to a popup window requesting it, unless you know what it is and the reason your credentials are required.
    Don’t open email attachments from email addresses that you do not recognize, or click links contained in an email:
    Most of these are scams that direct you to fraudulent sites that attempt to convince you to disclose personal information.
    Such "phishing" attempts are the 21st century equivalent of a social exploit that has existed since the dawn of civilization. Don’t fall for it.
    Apple will never ask you to reveal personal information in an email. If you receive an unexpected email from Apple saying your account will be closed unless you take immediate action, just ignore it. If your iCloud, iTunes, or App Store account becomes disabled for valid reasons, you will know when you try to buy something or log in to this support site, and are unable to.
    Don’t install browser extensions unless you understand their purpose. Go to the Safari menu > Preferences > Extensions. If you see any extensions that you do not recognize or understand, simply click the Uninstall button and they will be gone.
    Don’t install Java unless you are certain that you need it:
    Java, a non-Apple product, is a potential vector for malware. If you are required to use Java, be mindful of that possibility.
    Java can be disabled in System Preferences.
    Despite its name JavaScript is unrelated to Java. No malware can infect your Mac through JavaScript. It’s OK to leave it enabled.
    Beware spontaneous popups: Safari menu > Preferences > Security > check "Block popup windows".
    Popup windows are useful and required for some websites, but unsolicited popups are commonly used to deceive people into installing unwanted software they would never intentionally install.
    Popups themselves cannot infect your Mac, but many contain resource-hungry code that will slow down Internet browsing.
    If you ever receive a popup window indicating that your Mac is infected with some ick or that you won some prize, it is 100% fraudulent. Ignore it. The more insistent it is that you upgrade or install something, the more likely it is to be a scam. Close the window or tab and forget it.
    Ignore hyperventilating popular media outlets that thrive by promoting fear and discord with entertainment products arrogantly presented as "news". Learn what real threats actually exist and how to arm yourself against them:
    The most serious threat to your data security is phishing. Most of these attempts are pathetic and are easily recognized, but that hasn't stopped prominent public figures from recently succumbing to this age-old scam.
    OS X viruses do not exist, but intentionally malicious or poorly written code, created by either nefarious or inept individuals, is nothing new.
    Never install something without first knowing what it is, what it does, how it works, and how to get rid of it when you don’t want it any more.
    If you elect to use "anti-virus" software, familiarize yourself with its limitations and potential to cause adverse effects, and apply the principle immediately preceding this one.
    Most such utilities will only slow down and destabilize your Mac while they look for viruses that do not exist, conveying no benefit whatsoever - other than to make you "feel good" about security, when you should actually be exercising sound judgment, derived from accurate knowledge, based on verifiable facts.
    Do install updates from Apple as they become available. No one knows more about Macs and how to protect them than the company that builds them.
    Summary: Use common sense and caution when you use your Mac, just like you would in any social context. There is no product, utility, or magic talisman that can protect you from all the evils of mankind.

  • Phishing email pretending to be from iTunes?

    i have received what i am sure is a phishing email supposedly from iTunes.  is there an email address i should forward this to?

    help! I got this email and fell for it... now what do I do?
    Dear Customer,
    For your protection, we have temporarily restricted
    certain functionality with your Apple ID.
    These restrictions are to prevent potential misuse
    of your Apple account from authorize purchases.
    To restore full functionality of your Apple account,
    click here to login into your account and verify your
    Identity.
    Please do not reply to this automated email directly.
    Copyright � 2014 Apple Inc. All rights reserved.

  • I recieved a phishing email from amazon.

    I recieved a phishing email from amazon. I opened it on my ipod and entered information (stupid, I know). I didn't realize it was a scam. Apparently it is some kind of trojan virus. Is my ipod safe? What should I do now?

    Your iPod is fine. However, if you entered the requested information on the web site you were directed to, you have given that information to hackers. I don't know what information that was, but if you "logged in" to "Amazon" on that page, you need to immediately change your Amazon password. Make it a strong password that has no relation at all to your old password. Then check your Amazon purchase history to see if someone bought a bunch of stuff on your dime.

  • Increase in phishing emails supposedly from BT

    In the past few months I've noticed that I am getting more & more phishing emails pretending to be from BT.
    They are all going to an email account that I don't use anymore (but what I used to set up my internet with originally) but have forwarded to my current email address
    So there were a lot of BT Yahoo classic is closing ones, update your email, even had ones pretending that my bill was ready
    I reported one with the ebilling on it and BT kindly forced me to change my password as "my account has been compromised" (er no it hasn't).  So I'm reluctant to report any more.
    I'm just not sure what to do about them.  I obviously don't want genuine bt emails to go to the trash. 

    There are many phishing emails from BT doing the rounds no doubt trying to catch people out because of the forthcoming migration from Yahoo to Critical Path.
    If you hover your mouse over the senders email address it will show you where it came from and if you hover your mouse over any links you will see where the link will take you.
    Basically BT will not ask you to confirm any passwords, usernames or account details or verify accounts via links in an email. If you want to verify or change any of those, do it by going to the BT website via your web browser and not by clicking on links in emails.
    If in any doubt about an email, delete it.
    See link for details about phishing emails.
     http://bt.custhelp.com/app/answers/detail/a_id/9191/~/what-is-phishing%3F-is-the-email-i-have-receiv...

  • HELP.....PHISHING EMAIL QUERY

    I have received an email marked from: Your Apple Update Profile
    I have copy and pasted it below:
    Is this for real or is it a phishing email??
    At first I responded and gave my password but then once it asked for my updated payment method I stopped. It wasnt until some time later I realised that i had given my password and have now changed it.
    Apple Account [email protected]
    This e-mail is to inform you that your iCloud and Apple Account ([email protected]) has been momentary suspended until you can confirm your Apple Account details on file. This security measure to safeguard your Apple Account from unauthorized access. We apologise for the inconvenience you've been caused.
    How do I validate my Apple Account and remove the suspension?
    Just click the URL address below to verify ownership of your iCloud/Apple ID. Login in using your iCloud Account and password, then follow the prompts.
    > Verify My Apple Details
    When using Apple Inc devices and apps, you’ll still log-in with your main email address as your Apple login.
    If you have queries or want help, visit the Apple ID Support website.
    Regards,
    iCloud Guru Support
    Resolution Support ID: #L2KOI8218-EU139
    My Apple Account | Help | Privacy Policy | Email Preferences
    Copyright © 2014 iTunes Sarl 42-105, Rue Sainte Zithe, L-5483 Luxembourg All Rights Reserved.

    It is a phishing attempt. Do not respond. Do not divulge any personal or financial information. You can use the address below to forward the suspect email message to Apple.
    [email protected]
    The link below has information to help identify fraudulent emails.
    http://support.apple.com/kb/HT4933

  • Phishing emails appear in thunderbird despite being junked on my ISP site.

    My ISP successfully sends phishing emails from a source mimicking my ISP to Junk which then do not appear in the inbox. However, they do appear in TB inbox. How do I stop this. Advice gratefully received.
    Regards.

    ''It seems this email (and others) have their origin in TB. Is this possible?''
    No, it isn't. My best guess is the message slipped through your provider's spam filter. You have a POP account and the message gets removed from the server when you download it with Thunderbird.

Maybe you are looking for