This morning I received this e-mail:
Dear MasterCard Member,
For the User Agreement, Section 9, MasterCard may immediately issue a warning, temporarily suspend, indefinitely suspend or terminate your Credit Card and refuse to provide our services to you if we believe that your actions may cause financial loss or legal liability for you, our users or us. Our terms and conditions you agreed to state that your service must always be under your control or those you designate all times. We have noticed some unusual activity related to your service that indicates that other parties may have access and or control of your MasterCard Credit Card. We recently noticed one or more attempts to log in to your MasterCard Credit Card service from a foreign IP address
If you recently accessed your service while traveling, the unusual log in attempts may have been initiated by you. However, if you did not initiate the logins, please visit MaterCard homepage as soon as possible to restore your account status.
The log in attempt was made from – ISP host : domain-parking.martnet.com
To restore your Credit Card status please click here or click on the link below:
https://www.mastercard.com/us/personal/en/cardholderservices/securecode/index.html
Thank you for your prompt attention to this problem. Review Team apologize for any inconvenience. This is a security measure meant to protect you and your account.
Regards,
MasterCard Security Team.
Alarming, right? Looks authentic? A roll-over the link provided shows that it doesn’t actually go to the secure address
https://www.mastercard.com/us/personal/en/cardholderservices/securecode/index.html
but to this one unsecure one
http://211.174.53.78:81/www.mastercard.com/us/personal/en/cardholderservices/securecode/enroll.htm?sid=f512c549dea5b5bd341a1f97b2a2bc93
Click on it and you get a page requesting a bunch of personal information to “confirm” your identity. There are some screenshots here detailing the hoax.
I was suspicious to begin with, so I googled “phishing MasterCard Security Team” and voila — found the hoax. Even if I had clicked on the link, I would have been forewarned by McAfee Site Advisor (I have the highly recommended Firefox plugin).
If you get a phishing scam like this, don’t delete the e-mail right off. First forward the e-mail to pirt@castlecops.com. Castlecops tracks phishing, malware, and other internet evil and alerts and nags ISPs to stop abetting them.
Then, if you have Gmail, make sure you tap the “Report Spam” button.
End of PSA.
Recent Comments