« Love Hurts | Main | Confused Spammer »

May 29, 2008

I've heard of this before, but I don't like to report stuff unless I see it for real on my email server. Here's the entire message (last four phone number digits blocked by me):

From: Synergy Bank
To: dannyg@dannyg.com
Subject: Alert

Reach us urgently, call (800) 507-xxxx .

Aside from the awkward English, there are plenty of clues inside the message source that this is bogus. Most notably, I doubt that a New Jersey bank would send "personalized" email from a computer on a San Diego Cox.net connection. Second, the body of the otherwise simple message is base64 encoded, a technique generally used to confuse spam-sniffing content filters.

I'm not going to call the phone number, even though it appears to be a U.S. toll-free number. None of the toll-free phone number reverse lookup services I checked could tie the number to a known business. Although the practice has been banned by the FCC, crooks can still cause calls to toll-free numbers to be rerouted to international or other fee-based calling systems—creating charges that get put on the caller's bill. Recovering the bogus charges from the phone company is a nightmare, so I don't even want to get started.

But even if calling this number doesn't add fees to my phone bill, I suspect that the voice or recording on the other end of the line will demand personal identity information from me. It's simply another way to phish...without a web site.

If you were to receive a message like this, and by chance you had an account with the "sender," don't trust the emailed phone number any more than you would trust a clickable link in a phishing message. If you're a customer of that bank, use contact phone numbers on statements or listed at the bookmarked web site where you do your online banking to confirm the contact request. They'll tell you that they didn't send you the message, and you can get on with your life.

You might think that a toll-free number would be easy for law enforcement to trace and raid the miscreant's home Eliot Ness-style. But unless this turns into a widely spread scam, the target is probably too small potatoes to start investigating and building a case. Keep an eye out for more of this—what does one call it?—phphishing.

UPDATE (30 May 2008): As Kevin reminded me, the above is a variation of voice phishing, or vishing. The term originated from phishing schemes that use the telephone for all parts of the scam, including initial contact. Crooks could invade inexpensively (or freely with a hack or two) from outside the target's country with the help of Voice Over Internet Protocol (VOIP) services.