« And Malware Attachments Continue | Main | Falling Hard For a 419 Scammer »

November 13, 2008

I hadn't seen this type of thing in my inbox for quite awhile, so it's worth reminding email users that unexpected notices claiming to come from financial institutions—especially those with "click here" types of links—should be treated with full hazmat gear.

From: JPMorgan Chase & Co.
Subject: Add 50$ to your account in 2 minutes!

Dear Customer,

You are invited to take part in our nation-wide 5 question survey. Your time is very important to us so $50 will be credited to your account upon the completion of this survey.

Please note that no sensitive information will be required, collected or stored. The information will be used to further improve our services

To take part please click here

© 2008 JPMorgan Chase Co.

The hidden link is to an IP address. Apparently the server at that IP address is unused because there is evidence that either the phisher or someone else not only hacked into the server, but even left a note on the home page about which holes were used to gain access (including a reference to "week passwords").

If a recipient clicks the link, a redirect or two leads to another subdirectory on the same server, which displays a page containing what looks to be a typical customer survey, along with the Chase logo. At the end of the survey are some fields where the survey taker is to insert information so that the $50 will be credited to his or her debit or credit card account. You guessed it: you have to supply everything that a credit card thief needs to use the account or even create a phony card with magnetic stripe—including the ZIP code (which I've seen more and more gas pumps request before dispensing what until recently had been ultra-precious liquid).

Note that the message said that "no sensitive information will be required, collected or stored." Gimme a "B," gimme an "S."

With that, I'll relate a quick story. I picked up my ringing phone today. After that dreaded momentary delay signaling a computer-dialed call, a woman with a very heavy accent tried to identify herself as calling for Ziff-Davis. Her VOIP connection was very bad, and I'm still trying to get over a cold, so I had no patience for this intrusion. She asked when would be a good time to call me back. I replied, "If you're selling anything, I don't want you to call." "Oh no, sir," she countered, "I'm not selling anything. I have something free for you!" To that I said, "In that case you should certainly take this number off your list and never call again."