Original URL: http://www.theregister.co.uk/2003/08/12/twoinone_id_theft_fee_fraud/

Two-in-one ID theft, fee fraud scam debuts

Nipped in the bud, fortunately

By John Leyden

Posted in Media, 12th August 2003 16:39 GMT

Updated Scam artists who dupe users into revealing sensitive financial information have applied the social engineering tricks of 419-fraudsters in a new email scam.

Reg readers forwarded us copies of an email they received this morning, purporting to come from US-based e-payment company Swiftpay International (Swiftpay.us), which informs targeted individuals that they have 'won a prize'. Like numerous scams before it, Swiftpay.us tries to trick users into thinking it is a legitimate firm - in this case Swiftpay.com.

In the scam email, punters are told an administrative fee has been deducted from the supposed goodies (sounds familiar) they are been offered. It's implied that further fees will be taken off anyone who fails to enter their debit card details to receive the non-existent money.

By mid-afternoon (in Europe) the site had been pulled.

"Unlike most spams, this is not just annoying, it seems to be a fairly sophisticated attempt at identity theft," writes one Reg reader who'd received the email.

Indeed, the scam seems to combine advanced fee fraud tactics with a ruse designed to get people to hand over their financial information.

The email (copy below) first tells its target that they have a $976.40 payment waiting to be deposited in their bank account, but to receive the money they first need to be signed up as an account holder with Swiftpay.

As an added incentive, it is claimed that they've deducted $23.40 from the account already.

"Following the URL they provide leads to http://www.swiftpay.us/signup/ which is a quite sophisticated and realistic-looking website for a PayPal-style company," our correspondent said.

"The first page of the signup process requests details such as name and address, date of birth, Social Security Number and mother's maiden name. Further pages ask for a bank account number, credit card details (including the 3-digit security code from the back of the card), and ATM PIN number," he added.

The scam is nothing if not ambitious.

Our correspondent (who was shrewd enough not to be taken in by the scam) adds that despite what it claims on the Web site, none of this info would be sent over a secure connection.

"This (to me) appears to be a simple case of attempted identity theft, although it's been very well executed and made to look very realistic," he adds.

We quizzed a couple of scam experts, Andrew Goodwill of Early Warning and Graham Cluley of Sophos, which maintains a database on hoax emails. Both said if something looks too good to be true then it normally is. Users should be wary of strangers offering them money out of the blue for no particular reason, a hallmark of email scams. ®

From: support@swiftpay.us
To:
Subject: Transaction#: 218-185-15792
Date: Tue, 12 Aug 2003 02:01:52 +0000 (GMT)

Userktdinc just send $976.60 USD to you:

SwiftPay UserID: ktdinc
Transaction#:218-185-15792
Date: 12-08-2003

Comments: Membership #0218397 was selected to receive this month's bonus. We cannot send funds directly to your debit card's bank account because our merchant currently disabled this option. If you use your Lloyds TSB debit card, SwiftPay will not charge your card for the transfer, this is due to current promotion; we already deducted $23.40 from your funds for the service fees.

Your E-mail is not registered with SwiftPay. In order to receive your funds you need to apply for account with us and verify your identity. All information will be kept confidential. Please follow the link: http://www.swiftpay.us/signup/

When you enter our service your funds will appear in your account balance under overview page. You can withdraw the outstanding balance to your debit card account that you added during the registration process.

SwiftPay's intuitive interface makes sending and receiving money over the Web as easy as one two three. Simply logon at SwiftPay and select which SwiftPay service you wish to avail of, whether it's to fund your account, send money to friends family or businesses, request money or check your account details. With everything you need available at the click of a mouse, paying with SwiftPay couldn't be easier. Don't forget, we value our commitment to Customer Service at SwiftPay - should you have any queries, please don't hesitate to contact us andd we'll do our best to answer your query as soon as possible.

Kind Regards,

SwiftPay Customer Support

Related Stories

You've got Scam! ID harvest scam targets AOL users
Email scammers target Nochex users
Email scam aims to swipe PayPal users' credit card details
Amsterdam: home of the 419 lottery scam
PC builder takes 419ers for £171