I’m confused. I got an email from a company I’ve never heard of that included a link to a receipt for a $3,100.00 purchase that I never made. Should I call my credit card company??
Usually, email messages about non-existent purchases or transactions are what’s known as phishing scams, where they link to a banking site or legitimate merchant like Amazon.com, but secretly takes you to a fake page that looks legit and prompts you to enter your account credentials — you know, login + password — but instead of logging you in to the site you think you’re at, instead sends that login information to the bad guy. Who then logs in to the real site as you, changes your password, and exploits their newly acquired access for all sorts of nefarious purposes.
This time it’s more mundane and a lot easier for the bad guy: the message you’ve received is simply a virus waiting to infect you. In fact, if your email system is any good, it should already have been identified as spam.
Here’s a typical example:
I mean, it looks pretty legit, right? Well, except for the “3672 USD” rather than something like “$3672.00 USD”, but if you’re reading it quickly, well, yeesh, this looks legit, who wouldn’t want to get the receipt to see what’s going on?
Except that’s the problem.
If I move my cursor over the link, Apple Mail shows me the destination URL:
No real merchant is going to have a receipt up on Dropbox.com, and why the “.zip”?
Let’s download it to find out! Get the ZIP archive, unpack it and here’s what you find inside:
Fortunately I’m on a Mac system so “.exe” doesn’t instantly fill me with fear, but if you’re on a PC and unthinkingly open this executable, I can guarantee that it’s going to be bad and you’re going to really regret doing so.
The moral of this story: If you see a receipt for a bogus transaction, odds are very, very good it’s a phishing or virus scam or similar. Just delete it and go on your merry way, knowing your vigilance has foiled that dasterdly hacker!
Got one of these from Uniqlo. Also fake. Reported it as spam. It helps.
Yes this has just happened to me, said to go into Eway? It didn’t have my address or any postal address, but someone elses name and my email to a very old reading eggs acc, nothing seems to of been touched in my bank acc, but will look again tomorrow as it is a Sunday. Its a worry.
Hi, I was looking for advice about something that happens to me and I find it quite strange. The closest exemple I found was this mention here. But still not the same. I got mails to two different mail accounts. Some seem to come from Thailand, some from Sony in the Netherlands. But I have no credit card connected to those adresses. And there are are no strange purchases in my credit cards. The mails are adressed to people with different names, but not mine.
I believe there is some kind of fraud, but I can´t see wich. Somebody payed for something using my mail adress. The only thing I can think about is that this somebody uses somebodys else stolen credit card and uses random mail to missleed.
Do you have any explanation other than that? Am I at any risk?
Thank you.
I’ve seen this sort of thing with zero cost transactions. I think that they’re just indicative of some sort of crossed wires within the Sony database where someone has your email address but is using their own card. If you’re not seeing the transaction on your credit card statements, I wouldn’t worry about them, and if you are? Dispute it. And probably get a new card issued.
One other action to take: if the “fake” email shows any indication of being associated with a real bank or credit card company that you use yourself, log onto the bank/card company directly using your web browser and check your transaction history. You might be well-advised to do this from time to time anyway. It’s better to discover unauthorized transactions sooner than waiting for the statement to come each month.
Be aware that most credit card accounts have recent transactions in two categories, and you should check both of them: 1) cleared (meaning they have paid the merchant) and 2) pending (meaning a transaction has been created by the merchant but not yet finalized or paid by the company. Usually this is done for the purpose of verifying that the account is valid and good for the amount of the sale, or it can happen at a restaurant where they put your receipt balance through when they first get your card, and then a final transaction that includes any tip or disputed change in the charges).
One of my credit card numbers was used a couple years ago to put a deposit on a hotel in Peru, a place I have never been, nor have I any plans to go. The transaction was put on hold by the credit card company because it did not fit my spending profile. It sat in “Pending” while they investigated.