Scam Alert!!!!

mark beem · #1 06-19-2003, 10:15 PM

received this email last night supposedly from Best Buy alerting me of a suspicious order placed at their website.. Since I have no account with Best Buy and have not provided any information to them I immediately became suspicous. Here is the email I received:

Quote:

From: Bobbye Prams
To: markb6@nehp.net
Sent: Friday, June 20, 2003 1:28 AM
Subject: BestBuy Order #1095619. Fraud Alert.

Dear customer,

Recently we have received an order made by using your personal credit card information.
This order was made online at our official BestBuy website on 06/19/2003.
Our Fraud Department has some suspicions regarding this order and we need you to visit a special Fraud Department page at our web store where you can confirm or decline this transaction by providing us with the correct information.
Your e-mail address has been taken from National Credit Bureau.

Click the link below to visit a special Fraud Department page to resolve the cause of the problem.
BestBuy.com/fraud_department.html

------------------------------------------------------------------------------------------------------------------------------------------
ORDER# 1095619 - STATUS: SUSPENDED
ITEMS PURCHASED
------------------------------------------------------------------------------------------------------------------------------------------
Item No: 73890
CDA-9815 In-Dash CD Player/Ai-Changer Controller
Price: $387.65 Qty: 2 Total: $775.3
----------------------------------------------------------------------------------------------------
The order listed above has not yet been processed.
The reason for the delay in processing your order is:

- UNVERIFIED SHIPPING ADDRESS

- Information provided:
Shipping
41 WINHAM ST
Staten Island, NY 10306
United States
phone# 206-337-9843

In our effort to deter fraudulent transactions, we need your help in providing us with the correct information. Your prompt response is needed to avoid any unauthorized charges to your credit card.

Upon checking the Best Buy website I found this on the homepage"

Quote:

In the late afternoon of Wednesday, June 18, Best Buy became aware of an unauthorized and deceptive e-mail to consumers titled "Fraud Alert." This e-mail, which requests personal information (i.e., social security and credit card numbers), claims to come from the BestBuy.com Fraud Department. This message is NOT from Best Buy.

Best Buy is working with appropriate authorities to quickly resolve the situation. If you think you have replied to the fraudulent e-mail in any way, contact your bank and/or credit card companies immediately.

No Best Buy systems have been compromised, and our online business is secure. The privacy of your personal information is of the utmost importance to Best Buy and information you provide us is always handled according to our Privacy Policy.

If you have any questions, call Customer Care at 1-888-BEST BUY or visit our Online Pressroom.

To find out more about identity theft or providing your information to anyone, visit the Federal Trade Commission's Identity Theft Web site at http://www.consumer.gov/idtheft or call 1-877-ID THEFT.

Check out the Best Buy website for more info.. http://www.bestbuy.com

**Bob Gollihur** · #2 06-20-2003, 07:20 AM

There is a similar eBay fraud going on-- I've gotten two of the messages which look very legitimate and seem to do all the right things. It claims that your eBay invoice was not paid because the card authorization was rejected. It eventually takes you to a non-eBay site where you enter credit card info.

I think it is important to never click on links provided in any email address, but type in the legitimate site address and navigate to verify or disprove the email's claims. These bastards are getting more creative and competent at these scams.

John Sprague · #3 06-20-2003, 08:31 AM

I've always chuckled at these emails, til my wife asked me about one, she thought it sounded important and would have clicked it if I hadn't tackled her first. That's when I realized that intelligent people really can fall prey to this stuff. Things everyone should do for security's sake (a rehash of things you've probably heard, but what the hay):

1. Have your antivirus software scan both in-coming and outgoing mail, and set it to auto-delete suspicious files. I like Norton's best. Make sure you've set it to automajically update virus definitions at least once a week.

2. Don't use auto-preview, virus' can be launched in auto-preview mode.

3. Use a client other than Outlook Express if you can. Not that the software is bad, it's just the biggest target of script kiddies. Read your email in plain text, not html. HTML is code, code is bad in emails.

4. If you don't recognize the address, delete before opening. If it truly was important, they'll call you.

5. Use at least a software firewall like Zonealarm, which prompts you when any program tries to access the net, or access your computer. If you don't recognize the program, select "No". Be wary of creative program names that sound like microsoft.blahblah or winthis.exe or macthat.exe, old hacker's trick. Free firewall: www.zonealarm.com . Dial-uppers should use it too. A hardware firewall is best, meaning buy a router. Routers are hard to hack thru because they're dumb. The smart move is to use both soft and hardware firewalls.

6. Run Adaware every week. It's a free adware/spyware eliminator, at www.adaware.com . Also delete all cookies in your temporary internet files folder frequently.

7. Fear file attachments with a ".exe" extension, delete them fast.

8. Visit windows update (or the Mac equivelant) frequently. Most updates are security related, you want them. Only get your security updates from the actual Windows Update site, don't respond to pop-ups or emails that say you're not secure. Windows or Mac will never email a security update.

This is the basic security list, there is more you can do but this stuff should cover you pretty well.

I did however receive an email with the topic "Mr. Sprague, enlarge your breasts now", but it was from Nick with no attachments so I read it.

mark beem · #4 06-20-2003, 08:35 AM

Thanks for the info.. However, this was not a virus.. It was an attempt to get personal and financial information.. Identity theft..

In this instance it'd probably be better to check the company's website as I did... There was a BIG announcement at the top of the page about this scam.

Barefoot Larry · #5 06-20-2003, 08:07 PM

Quote:

Originally posted by Bob Gollihur
There is a similar eBay fraud going on-- I've gotten two of the messages which look very legitimate and seem to do all the right things.

I've gotten a couple of emails supposedly from "paysecurity@paypal.com" saying "This e-mail is the notification of recent innovations taken by PayPal to detect inactive customers and non-functioning mailboxes.

The inactive customers are subject to restriction and removal in the next 3 months." and wanting me to give complete credit-card information PLUS my ATM Pin# "for bank verification".

What ticks me off is that I've sent two emails to PayPal and not heard anything back.

FWIW, I got an email from BestBuy.com that was the warning from their website, pretty much word-for-word, though I didn't get one of the emails it was warning about.

**Damon Rondeau** · #6 06-20-2003, 08:34 PM

I've done a lot of buying over the net and have never had any problems. I'm quite computer literate, which is an asset not everyone has, BUT common sense should come into play.

As far as I'm concerned, a vendor has one chance to get my credit card information in a transaction. Sometimes (more often than it should), a post will hang (i.e., you'll fill in the form, hit return, and watch things foul up somehow.) Then it's time to use e-mail or the phone to confirm what the hell happened.

No reputable vendor will ever approach you after the fact, for any reason, to get credit/personal information.

It doesn't matter how official the presentation of the request is, it's no different than someone approaching you on the street and asking to have a look at your wallet. Maybe a drummer might hand it over, but surely not we bass players....

I still have the willies leaving my credit card info in a database somewhere, but I've done it. Watch those statements!

BTW, I was just reading in the paper today about a guy found guilty in a British Columbia or Alberta court (somewhere in western Canada, could even have been here.) Described as an longtime conman in his 60's, he'd been running the Nigerian "free the money" scam, and the paper said he'd bilked $6 million out of it! Hard to believe. He got 18 months probation....

John Sprague · #7 06-21-2003, 12:43 AM

Quote:

$6 million

Now that is amazing.

**Bob Gollihur** · #8 06-21-2003, 06:45 AM

There are far more sophisticated scams-- I lost $2500 to Enron.

What I want to know is, why are they chasing Martha Stewart when they should be jailing Kenneth Lay??

Political connections are today's Get Out Of Jail cards.

Eric Jackson · #9 06-25-2003, 07:38 AM

Thanks for the security info, John. Have a router, didn't know about Zonealarm or Adaware. Will download.

Is this a great site, or what?

John Sprague · #10 06-25-2003, 10:26 AM

Indeed it is Eric, especially with guys like webmeister Bob G. attending regularly.

Quote:

Subject: BestBuy Order #1095619. Fraud Alert.

What bothers me about that particular scam is that the title is good enough to get you to open it. So many people are still running without a good anti-virus program that a hacker kiddie could use a title like that to launch a virus from and have some measure of success.

mark beem · #11 06-25-2003, 10:38 AM

Quote:

Originally posted by John Sprague
So many people are still running without a good anti-virus program that a hacker kiddie could use a title like that to launch a virus from and have some measure of success.

The one I have is AVG.. It's by far the best anti-virus program I've ever seen.. It's free also.

It can be downloaded here: www.grisoft.com