A high-tech version of an old-fashioned con job
The email arrived at 9:38 a.m., shortly before Amy and I left for Roanoke and my long day with a dentist. It read:
Dear Bank of Floyd Customer,
This is your official notification from Bank of Floyd, your online account has expired. If you want to continue using our service you have to renew your online account. If not, your online account will be deactivated and deleted.To continue click here, complete the renew form with your current information.
Many Thanks and Kind Regards - Bank of Floyd - Update Department
I immediately sent the message to the trash bin, recognizing it as a "phishing" expedition, an attempt by a con artist to gain access to an online bank account. We get these things all the time, sometimes claiming to be banks we actually do business with and more often "from" banks at which we've never had an account.
But some did fall for it, including area blogger David St. Lawrence, who had to close his account, open a new one and get new ATM cards.
Usually, "phishing" con jobs go to a shadow url that spoofs the original URL of a bank but this one used the url: bankofloyd.com, which looked authentic unless you looked closer and realized there was an "f" missing (it should have been bankoffloyd.com). Alert users of the Bank of Floyd's online service also know that the bank's real online banking service url is "secureinternetbanking.com."
I've done business with The Bank of Floyd long enough to know that they, like most other banks, never, ever use email for sensitive banking business. They make that fact very clear in mailings, on signs in the bank and when you open an account. If you are an online banking customer, they send messages through the system's secure messaging center and then let you know that you a message waiting there.
David checked the registration of the "bankofloyd.com" url and found it was registered on June 6 (last Friday) by a "Ted Kaczynski" using a drop box in New York City.
Ted Kaczynski? Ted Kaczynski is the unibomber, the madman who killed three and wounded 23 with mail bombs before his arrest on April 3, 1996. He is serving life without parole at the Federal Supermax prison in Colorado.
Phish Bait
I thought I was pretty sophisticated about phishing until I got an email from "Chase" informing me that I had a new message. It looked just like the the real ones so I clicked the link, got to a login screen that looked right and after entering userid/pw combination, it said that the site was down and to try again later. That's when I noticed that the link wasn't using https so I immediately went to the real site and changed the pw. By luck, the only account that they could have accessed at that link was a gas card. Since I never activated the ATM feature, the only thing they could have done was to pay my bill for me. Even so with a credit limit that used to be good for about 18 months worth of gas (figuring 3 x $10 fill ups per month in 2001). That car broke its leg and I had to shoot it -- the new one has a bigger tank so I only have to fill it 2-1/2 times a month but each fill up is more like $50
the amount of work that some
the amount of work that some people put in to avoid honest work astounds me. I am hopeful that this was caught early enough that no one will be taken for much. It's a crazy world.
Thanks for the Warning!
Doug - In my ignorance, I probably would have taken the bait! Of course, if anyone had gotten access to my account, they would have been quite disappointed!
Foiled
My home page has been hijacked by a tertiary marketing scheme that leads to interent speedway so I called them and firmly but nicely implied that I did not appreciate all the work I had to do to remove this , cost etc. They were adamant
so I reported them for internet fraud and whoops accidentally checked the FBI box..
Post new comment