Feeds

Two-in-one ID theft, fee fraud scam debuts

Nipped in the bud, fortunately

  • alert
  • submit to reddit

SANS - Survey on application security programs

Updated Scam artists who dupe users into revealing sensitive financial information have applied the social engineering tricks of 419-fraudsters in a new email scam.

Reg readers forwarded us copies of an email they received this morning, purporting to come from US-based e-payment company Swiftpay International (Swiftpay.us), which informs targeted individuals that they have 'won a prize'. Like numerous scams before it, Swiftpay.us tries to trick users into thinking it is a legitimate firm - in this case Swiftpay.com.

In the scam email, punters are told an administrative fee has been deducted from the supposed goodies (sounds familiar) they are been offered. It's implied that further fees will be taken off anyone who fails to enter their debit card details to receive the non-existent money.

By mid-afternoon (in Europe) the site had been pulled.

"Unlike most spams, this is not just annoying, it seems to be a fairly sophisticated attempt at identity theft," writes one Reg reader who'd received the email.

Indeed, the scam seems to combine advanced fee fraud tactics with a ruse designed to get people to hand over their financial information.

The email (copy below) first tells its target that they have a $976.40 payment waiting to be deposited in their bank account, but to receive the money they first need to be signed up as an account holder with Swiftpay.

As an added incentive, it is claimed that they've deducted $23.40 from the account already.

"Following the URL they provide leads to http://www.swiftpay.us/signup/ which is a quite sophisticated and realistic-looking website for a PayPal-style company," our correspondent said.

"The first page of the signup process requests details such as name and address, date of birth, Social Security Number and mother's maiden name. Further pages ask for a bank account number, credit card details (including the 3-digit security code from the back of the card), and ATM PIN number," he added.

The scam is nothing if not ambitious.

Our correspondent (who was shrewd enough not to be taken in by the scam) adds that despite what it claims on the Web site, none of this info would be sent over a secure connection.

"This (to me) appears to be a simple case of attempted identity theft, although it's been very well executed and made to look very realistic," he adds.

We quizzed a couple of scam experts, Andrew Goodwill of Early Warning and Graham Cluley of Sophos, which maintains a database on hoax emails. Both said if something looks too good to be true then it normally is. Users should be wary of strangers offering them money out of the blue for no particular reason, a hallmark of email scams. ®

From: support@swiftpay.us
To:
Subject: Transaction#: 218-185-15792
Date: Tue, 12 Aug 2003 02:01:52 +0000 (GMT)

Userktdinc just send $976.60 USD to you:

SwiftPay UserID: ktdinc
Transaction#:218-185-15792
Date: 12-08-2003

Comments: Membership #0218397 was selected to receive this month's bonus. We cannot send funds directly to your debit card's bank account because our merchant currently disabled this option. If you use your Lloyds TSB debit card, SwiftPay will not charge your card for the transfer, this is due to current promotion; we already deducted $23.40 from your funds for the service fees.

Your E-mail is not registered with SwiftPay. In order to receive your funds you need to apply for account with us and verify your identity. All information will be kept confidential. Please follow the link: http://www.swiftpay.us/signup/

When you enter our service your funds will appear in your account balance under overview page. You can withdraw the outstanding balance to your debit card account that you added during the registration process.

SwiftPay's intuitive interface makes sending and receiving money over the Web as easy as one two three. Simply logon at SwiftPay and select which SwiftPay service you wish to avail of, whether it's to fund your account, send money to friends family or businesses, request money or check your account details. With everything you need available at the click of a mouse, paying with SwiftPay couldn't be easier. Don't forget, we value our commitment to Customer Service at SwiftPay - should you have any queries, please don't hesitate to contact us andd we'll do our best to answer your query as soon as possible.

Kind Regards,

SwiftPay Customer Support

Related Stories

You've got Scam! ID harvest scam targets AOL users
Email scammers target Nochex users
Email scam aims to swipe PayPal users' credit card details
Amsterdam: home of the 419 lottery scam
PC builder takes 419ers for £171

3 Big data security analytics techniques

More from The Register

next story
Dropbox defends fantastically badly timed Condoleezza Rice appointment
'Nothing is going to change with Dr. Rice's appointment,' file sharer promises
Audio fans, prepare yourself for the Second Coming ... of Blu-ray
High Fidelity Pure Audio – is this what your ears have been waiting for?
Record labels sue Pandora over vintage song royalties
Companies want payout on recordings made before 1972
MtGox chief Karpelès refuses to come to US for g-men's grilling
Bitcoin baron says he needs another lawyer for FinCEN chat
Number crunching suggests Yahoo! US is worth less than nothing
China and Japan holdings worth more than entire company
Zucker punched: Google gobbles Facebook-wooed Titan Aerospace
Up, up and away in my beautiful balloon flying broadband-bot
Apple DOMINATES the Valley, rakes in more profit than Google, HP, Intel, Cisco COMBINED
Cook & Co. also pay more taxes than those four worthies PLUS eBay and Oracle
prev story

Whitepapers

Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.