Date Reported 16th February 2005
Apparent Sender Earthlink
Return Address Earthlink billing depatment < billing@earthlink.net >
Subject EarthLink Account Expired - Update Now
Format HTML
Method Spoof email links to a spoof webpage where victim is prompted to enter their details believing the site is genuine. Details are then forwarded to a local script and captured.
Bogus Web Content? Yes
URL of web content http://earthlink-billing-dptm.com
RISK LEVEL MEDIUM
WARNINGS 1. Email claims to be from Earthlink asking you to enter your account data by clicking on the link. You will be taken to a spoof login page where your details will be captured by the phishers.
2. Earthlink never send users emails requesting details in this way.
3. URL of spoof website disguised as "Click here"
4. Real URL looks nothing like Earthlink.
5. The email looks unprofessional, and is full of bad grammar and bad spelling - a sure sign of a scam.
6. Website traced to Pawtucket, USA.
"Dear EarthLink member, your EarthLink membership is temporary FROSEN! "
If you have received this email, please remember that it is very common for these email scams to be redistributed at a later date with only slightly different content or the same but with the fake page(s) hosted by a different provider. Also, once you have received one of these hoaxes, it is also common place to receive at least another one and usually a day or two after the first, although not necessarily from the same apparent sender.
The Spoof Email ...
Dear EarthLink member,
your EarthLink membership is temporary FROSEN!
Identity theft and identity fraud are terms used to refer to all types of
crime in which someone
wrongfully obtains and uses another person's personal data in some way
that involves fraud or
deception, typically for economic gain. Unlike your fingerprints, which
are unique to you and cannot
be given to someone else for their use, your personal data especially your
Social Security number,
your bank account or credit card number, and other valuable identifying
data can be used, if they
fall into the wrong hands, to personally profit at your expense. Due to
the recent increase of credit
card fraud operations, we decided to toughen our antifraud measures. To
continue your EarthLink membership
we now require you to update your billing information and fill out some
additional fields such as ATM PIN-code,
Social Security Number, Mother's Maiden Name and Date Of Birth since it is
impossible for a scammer to know it.
Our fraud department team requires you to confirm your identity and that
you are indeed the cardholder
of the credit card, by providing this information. Your EarthLink
membership will not be continued
until we receive this confirmation.
Click here to update your information
Sincerely yours, © 2005 EarthLink, Inc. All Rights Reserved.
The Spoof Website ...
Spoof website not online at time of report...
|
