Donny gets Phished

[Donny Carlson]

Sad to say, yours truly was the victum of clever Intenet thieves this week, who managed to steal $200 from my checking account via two ATM withdrawals... From Alpha Bank in Moscow, Russian Republic, even though my ATM card was in my wallet at the time.

I get emails from my bank, SouthTrust (now merged with Wacovia) that notify me of direct deposits, when my account drops to a certain balance, etc. On Tuesday, I got this very alarming email which was IDENTICAL to SouthTrust email, even down to the bank logo and current marketing slogan:

<!--StartFragment -->__________________
Dear Customer,

SouthTrust Bank, is committed to maintaining a safe environment for our customers. To protect the security of your account, SouthTrust Bank, employs some of the most advanced security systems in the world and our anti-fraud teams regularly screen the SouthTrust system for unusual activity.

We are contacting you to remind you that on Dec. 28, 2004 our Account Review Team identified some unusual activity in your account. In accordance with SouthTrust's User Agreement and to ensure that your account has not been compromised, access to your account was limited. Your account access will remain limited until this issue has been resolved. We encourage you to log in and perform the steps necessary to restore your account access as soon as possible. Allowing your account access to remain limited for an extended period of time may result in further limitations on the use of your account and possible account closure.Visit now Online Banking page and perform verification process:

Log In To Online Banking Page: (note not a real link - Donny)

Thank you for your prompt attention to this matter. Please understand that this is a security measure meant to help protect you and your account. We apologize for any inconvenience.

Sincerely,
SouthTrust Bank., Account Review Department

_______________________

When you clicked on the link above, it took you to the bone fide SouthTrust online web site, with the proper "HTTPS" in the address line, and the lock icon, indicating a secure site. Over this was a pop up window. It looked like this:

http://www.southtrust.com/NR/rdonlyres/139A8756-6879-4B78-A978-06E1F85D8E29/0/alert_emailfraud.jpg

As you can see, the popup looks to be authentic, even has a lock symbol. Thinking my account was restricted or frozen, and looking at this on my screen believing I was on a secure SouthTrust web site, I entered the information in the window, got a "Your identity is confirmed and the restriction on your account is now lifted, thank you" message" What I did was give some phisher jerk in Russia all the information needed to create a duplicate ATM card and the PIN to be able to use it. Which they did. The only reason I lost only $200 was because my checking account balance that day was $257, they made two, $100 withdrawals, then attempted a third $100 withdrawal, which was declined.

The scariest part is they also had my online user name and password, which could allow them to transfer funds, AND check my balances in all my accounts. And my paycheck was direct deposited on Thursday evening. They could have stolen my entire paycheck.

I discovered the theft in time to cancel my ATM card and change my online password and user id. Fortunately, under FTC rules, unathorised use of an ATM card has a limit of liability of $50 as long as you report the crime within 2 business days. I reported it within this time, and SouthTrust has told me that once they receive a notarised affidavit from me, I'll get all the $200 credited back plus the ATM service fees. But shhhhoooooot, it could have been nasty had they stolen an entire pay check without my knowledge, especially with checks and electronic payments not clearing.

Never, I mean NEVER, give out account information over the Internet, even if it looks authentic and has Verisign clearance, secure icons, etc. Thieves are one step ahead of these safeguards and WILL get you eventually.

Google shows that this scam is being used with other banks and credit cards, too, so be forewarned.

I am just happy they only got $200, and that eventually I'll get it back.

[MM03MOK]

I get these phishing emails weekly at work, mostly from banks ("PayPal" too) and none that I do business with. I also never use my work email for anything personal, so two reasons to be suspicious. Do report it to your ISP. I know at Comcast, a team is in place to investigate phishing reports.

Thank you, Donny, for reminding everyone to be extremely careful. I'm glad your bank will make you whole.

[BK_GrandMarquis]

Sad to say, yours truly was the victum of clever Intenet thieves this week, who managed to steal $200 from my checking account via two ATM withdrawals... From Alpha Bank in Moscow, Russian Republic, even though my ATM card was in my wallet at the time.

I get emails from my bank, SouthTrust (now merged with Wacovia) that notify me of direct deposits, when my account drops to a certain balance, etc. On Tuesday, I got this very alarming email which was IDENTICAL to SouthTrust email, even down to the bank logo and current marketing slogan:

<!--StartFragment -->__________________
Dear Customer,

SouthTrust Bank, is committed to maintaining a safe environment for our customers. To protect the security of your account, SouthTrust Bank, employs some of the most advanced security systems in the world and our anti-fraud teams regularly screen the SouthTrust system for unusual activity.

We are contacting you to remind you that on Dec. 28, 2004 our Account Review Team identified some unusual activity in your account. In accordance with SouthTrust's User Agreement and to ensure that your account has not been compromised, access to your account was limited. Your account access will remain limited until this issue has been resolved. We encourage you to log in and perform the steps necessary to restore your account access as soon as possible. Allowing your account access to remain limited for an extended period of time may result in further limitations on the use of your account and possible account closure.Visit now Online Banking page and perform verification process:

Log In To Online Banking Page: (note not a real link - Donny)

Thank you for your prompt attention to this matter. Please understand that this is a security measure meant to help protect you and your account. We apologize for any inconvenience.

Sincerely,
SouthTrust Bank., Account Review Department

_______________________

When you clicked on the link above, it took you to the bone fide SouthTrust online web site, with the proper "HTTPS" in the address line, and the lock icon, indicating a secure site. Over this was a pop up window. It looked like this:

http://www.southtrust.com/NR/rdonlyres/139A8756-6879-4B78-A978-06E1F85D8E29/0/alert_emailfraud.jpg

As you can see, the popup looks to be authentic, even has a lock symbol. Thinking my account was restricted or frozen, and looking at this on my screen believing I was on a secure SouthTrust web site, I entered the information in the window, got a "Your identity is confirmed and the restriction on your account is now lifted, thank you" message" What I did was give some phisher jerk in Russia all the information needed to create a duplicate ATM card and the PIN to be able to use it. Which they did. The only reason I lost only $200 was because my checking account balance that day was $257, they made two, $100 withdrawals, then attempted a third $100 withdrawal, which was declined.

The scariest part is they also had my online user name and password, which could allow them to transfer funds, AND check my balances in all my accounts. And my paycheck was direct deposited on Thursday evening. They could have stolen my entire paycheck.

I discovered the theft in time to cancel my ATM card and change my online password and user id. Fortunately, under FTC rules, unathorised use of an ATM card has a limit of liability of $50 as long as you report the crime within 2 business days. I reported it within this time, and SouthTrust has told me that once they receive a notarised affidavit from me, I'll get all the $200 credited back plus the ATM service fees. But shhhhoooooot, it could have been nasty had they stolen an entire pay check without my knowledge, especially with checks and electronic payments not clearing.

Never, I mean NEVER, give out account information over the Internet, even if it looks authentic and has Verisign clearance, secure icons, etc. Thieves are one step ahead of these safeguards and WILL get you eventually.

Google shows that this scam is being used with other banks and credit cards, too, so be forewarned.

I am just happy they only got $200, and that eventually I'll get it back.

There are two things to keep in mind. Never use a link from an email. Always go directly there from a URL that you know or type manually. I've noticed official emails from my bank/cards use my real name while addressing the email, not "dear customer". I've gotten bogus emails from what looks like one of my cards before.

[BruteForce]

Also note that if you get an email that your account has been "frozen" or some other alarming action that might prompt you to click on a link, STOP... pick up the phone and call first. Verify that there is indeed a problem with your account before doing anything else.

We have all become too complacent and trusting of the Internet. No you're not paranoid... they ARE out to get you. :depress:

PS. Sorry to hear about your misfortune.

[Silver_04]

I get fake e-mails all the time regarding my internet service and "someone" wanting to verify my credit card and personal info. When they wanted the rights to my first born...I got really suspicious.

Some internet service providers provide a tool which will tell you whether a particular URL is legit or not, but I don't trust those much. When in doubt, get the phone out and place a call.

Glad it sounds like everything is going to get resolved.

[QWK SVT]

Sad to say, yours truly was the victum of clever Intenet thieves this week, who managed to steal $200 from my checking account via two ATM withdrawals... From Alpha Bank in Moscow, Russian Republic, even though my ATM card was in my wallet at the time.

I get emails from my bank, SouthTrust (now merged with Wacovia) that notify me of direct deposits, when my account drops to a certain balance, etc. On Tuesday, I got this very alarming email which was IDENTICAL to SouthTrust email, even down to the bank logo and current marketing slogan:

Working for a Canadian financial institution, I know all to much about this sort of thing. Phishing / email fraud is becoming a very large problem. If you have the ability to look at the full header details, you will likely find that the email originated from somewhere odd... That's a surefire sign that somethin' ain't right.

If you have not already done so, you should report this to your FI. As a rule of thumb, I will never follow a link from an "official looking email" - I know my bank's website, and will always manually type it in... BruteForce's tip is a good one - Every bank will have some sort of 24-hour 1-800 telephone banking service, that can answer your questions.

[2003 MIB]

Way to look out for your buddies, Donny!!!!!!!!!!!!!!!!!:bows: :bows: :bows:
Thanks for the warning. I've become more cautious with snail mail too...I shred everything now...It's smart AND it annoys the wife:D

[martyo]

I've become more cautious with snail mail too...I shred everything now...It's smart AND it annoys the wife:D

Plus it makes for comfy bedding material when she makes uyou sleep in the garage! :D

[2003 MIB]

Plus it makes for comfy bedding material when she makes uyou sleep in the garage! :D
Mmmmmmm, sleeping in the garage with nothing but the gentle sound of my Marauder depreciating and sensuous aroma of the Jag's leaky fuel pump. :o

[martyo]

Mmmmmmm, sleeping in the garage with nothing but the gentle sound of my Marauder depreciating and sensuous aroma of the Jag's leaky fuel pump. :o

Easy there Dan..... :P

[ckadiddle]

An easy rule to remember is that unless YOU initiate the contact, don't trust it. Same principle as not giving your Mastercard number to a telephone solicitor that calls YOU.

[Donny Carlson]

If you have not already done so, you should report this to your FI. As a rule of thumb, I will never follow a link from an "official looking email" - I know my bank's website, and will always manually type it in... BruteForce's tip is a good one - Every bank will have some sort of 24-hour 1-800 telephone banking service, that can answer your questions.
I've reported it, cancelled the ATM card, and closed my account. The bank has been great about it, and they say I'll get all the money stolen from my account back. FTC rules say that I am liable for the first $50, so if they refund it all, I will be a happy boy.

This was extremely clever email and web sitage. The email was identical to real SouthTrust email, down to the logos and slogan. The email linked to the real SouthTrust web site, but had a popup that looked exactly like the popup you get when you set up your online account. It was very convincing.

Interestingly, I got nearly the same email this morning, only the subject line was diffierent.

WHOIS searches point to APNIC, which washes its hands of such things, and to KRNIC, who also denies responsibility. The two emails point to different servers at different ISP's, both in Seoul, Korea. Since the crime was carried out at a branch ATM of Alfa Bank in Moscow (perversely, I looked up the map for this ATM, and it's conveniently across the street from the Metro station), I can only surmise that the thieves use a proxy server, or somehow buy space on the Seoul server. Whatever.

I emailed Alfa Bank to let them know they have thieves using their ATMs to steal money, though my guess is they couldn't care less.

It has been a massive hassle and inconvenience, but lessons learned hard are lessons learned well.

[Gent4157]

Donny, I just received the same E-mail this morning, but I don't have an account at Southtrust. I will be glad to save the e-mail if it will help you trace them in any way. Good luck.

[Marauderjack]

I get several emails like this per week from banks I never heard of!!! :mad2:

I also got one from my internet provider asking for a bunch of personal and financial info....It started out "Darling Earthlink Customer".......Wouldn't you think that would raise a flag......%#@*ing MORONS!!!! :mad2: :mad2:

Don't do any financial stuff on the i-net PERIOD.....unless it is on this site (sorry Logan)!!!! :o

Marauderjack :bandit: