So i got this message from "Bank of America"
from: bankofamerica@locked.com

Message from Bank Of American. Debit Mastercard Locked. Please call : 8882119377

So I figure, sure i'll bite. From a spoofed number I dial and wait to see what i get. In a computer synthesized voice, "Thank you for calling bank of America, we regret to inform you that your card has been locked. Press 1 to unlock and 2 to leave." so i press 1. then it asks for my 16 digit card number. I try a fake 123456 sequence first. They have an algorithm in place to verify for proper card placement. Ok fine.. i'll use a "real" card number.
This one took, then they asked for:
expiration date
pin number
and last 4 digits of the social security number.

they even built in a "please wait will you card is being reactivated", 5 second pause, "your card has been reactivated".

A few things stand out here that it's not real. first of all, i don't have a bank of america debit card, a valid intuition wouldn't have a synthesized voice in their IVR. And they wouldn't ask for all that information. at most perhaps a portion of that data. The safest way to see if your card really is "locked" is to call the institution directly, (not with the number provided in the email) and SPEAK to someone about your account.

A new tactic is afoot.  This one is even more cleaver than other ones i've seen.  They go around the phishing philters and compromised websites by delivering the html directly to you via a hashed url.  PLEASE, take caution when opening links from email, even if they appear from someone you know.  Verify with the person before you actually do give up personal information..

I got an email today:

So this email is coming from someone i know, they are using that person's name in the message.  The red flags in this message is.. the lack of consistency in the fonts, the urgency of clicking on the link, (it's very important) and the fact that no other information is included such as what the document is that he wants me to read.

Read More »

This email came through today.  They are banking on the chance that the person getting the email will think that someone they know has passed and want to find out more by clicking on the link.  The link actually takes users back to a different site that has been compromised to include the malicious link.  Take caution when an email wants you to click on a link.