Worm

[LR827]

QUOTE(Paddy @ Apr 21 2012, 10:34 AM) <{POST_SNAPBACK}>

Lorraine, no doubt your email is being assaulted by infected computers - no human being could send out that much spam without a whole lot of help! Why you've gotten so much of it, and why it seems to make no sense (no links, no malware attachments...not advertising anything or trying to get you to help some poor soul in Nigeria who has been left $60M and needs your bank info to er, liberate it) is the big mystery. Maybe it's a test project.

I have looked every which way I could think of to find anyone experiencing anything similar, but either my Google skills have failed me, or you're in a very select group. When people complain about large amounts of spam, generally it's a few hundred a day - not 22,000!!

 
Paddy, I've started a new topic because this is the issue. I don't think it has anything to do with my AOL account, per se. I think my Bill Me Later acct (now closed) was hacked into on which I had listed that AOL account. The purpose of flooding my email acct. with thousands of spam messages was to DISGUISE the 2 emails I got from the websites the spammers had ordered expensive items from.

Look at the advice I got from everywhere, "You may have to dump the AOL account." That is EXACTLY what the spammers wanted. Here is how it (almost) worked (forgive me if I repeat what I wrote in the other strings, for anyone who has not read it):

My AOL acct was swamped with thousands of gibberish emails from international and national domains. There were no links to click on, as found in "ordinary" spam. Naturally, I just started trashing these emails as they came in -- I was hoping to save the AOL account and not dump it, but it looked like I would have to dump it.

On the second day, the email onslaught slowed -- Now I was getting email sent 10 minutes apart, instead of a hundred sent at the same minute, as it was doing initially. Then ONE email JUST HAPPENED to catch my eye: the Subject was, "Thank you for your order." I opened it to find an order for an $800 camera from Overstock . com. I called Overstock and found the order charged to my Bill Me Later account. My name and address were in the "Bill-to" section but the "Ship-to" address was different. The order was cancelled as fraudulant. I contacted Bill Me Later and closed that account.

Still scanning my email carefully now, there was a second "Thank you" order -- a Vaio computer for $900 from mWave . com. This was also charged to my Bill Me Later account. Same story. I have not noticed any more orders coming through, but the purpose of the massive, seemingly pointless email, was to get me to trash them without reading them, and then to dump to AOL account. That way, I would never know about other orders until the end of the month when I received my bill from Bill Me Later. By that time, they would have picked up the merchandise from the "ship-to" address -- possibly a mail drop -- and I would be left to dispute with Bill Me Later. Unlike my banks and credit cards, BML sends no alert that a transaction has taken place. And if they did, I might have trashed it without reading it, along with the mass of spam.

Now, having just finished reading "Worm" about the Conficker C botnet, which has infected millions of PC's and linked itself in a peer-to-peer manner, I couldn't help thinking that must be related to this. They never knew what the exact purpose of this gigantic botnet was, but possibly they would sell "pieces" of it to spammers for theft activity. This would fit it exactly. Now, I'm not sure where/who to notify?

This is what I am doing to protect myself in the future (and I think Paddy may have suggested something like this): I will set up separate email accounts for every credit card and bank account I have, each one forwarded to a central account. In the event I get another massive email infestation, the email account itself will tell me what account has been compromised.

For example, I'll set up an email acct "A-Bank @ aol . com" for my A Bank account; and "B-Bank @ aol . com" for my B Bank account. I can view all of these in Mac-Mail, so the minute I notice email there, I'll know which account has been compromised.

Does anyone have another other suggestions, or thought about this? Scary stuff.

Lorraine

[jchuzi]

Many banks allow you to set up a one-time credit card number, to be used only for a specific purchase. After that purchase is completed, the number is no longer valid. You may want to explore that.

[Xairbusdriver]

While the more email alias' or real accounts can help narrow down who is doing he SPAMming and makes it easy to block/stop, I don't recommend more than one CC account. You create an alias for just about every place you shop and use it only there. If you start getting SPAM/SCAMs to that address, you'll know exactly which merchant was hacked.

The more credit cards you have, the more you have to watch/monitor! But remember, you are NOT liable for fraudulent use of your CC number. So, why bother with more than one? Your liability is limited to $50 if you lose your actual card, but you should know that pretty quickly since it probably means you've lost your purse or pocket book. So, when you lose the CC "container," report that to the CC company immediately. Of course, if you have more than one, you'll have to notify them all. And you could be charged $50 for every one that is used!

You can also try setting up a "Thanks for the Order" mailbox and create a rule to put anything with some or most of those words in the Subject into it. Saves looking through thousands of messages in your Inbox. Of course, I still think you should buy SpamSieve and start training it with all those bad messages before they stop coming. You might be surprised at how it could help. I can't remember the last time the developer requested a payment for an update... it's a bargain at $30!

EDIT: Paddy said it better than I did about credit card(s). It's none of my business how many you have, anyway. The point is, if possible, use only one for on-line purchases. Sorry for being less than helpful and/or offering less than 2¢ worth!

[Paddy]

Lorraine, again - I've looked and couldn't find any reports of anything similar to what happened to you. So, as I said - you may have been an "experiment" - who knows. Yours is a plausible theory, though I'd be interested to know what the results would be if you sent a bunch of those emails through SpamCop. I'd be particularly interested in knowing just how many different spots those emails were actually coming from.

Lots and lots of really unhappy Bill Me Later customers though...

http://bill-me-later.pissedconsumer.com/complaints.html

I would continue to keep a close eye on things - 1. to make sure that your BML account WAS closed and that you don't find yourself dogged with "late fees" etc. as has happened to some other uses and 2. to make sure that your AOL account is secure.

Quite frankly, I'd not recommend using AOL for anything at all...and I certainly wouldn't add accounts there. (It still has the reputation, deserved these days or not, of being the domain of spammers and those who don't know any better. I'm always suspicious of email from AOL - as I am with email from Hotmail)

I'd recommend using only ONE credit card online - and checking your statement online more often than via the monthly printed statement. I use a (one) Gmail account for some retailers and my primary account for some others (most trusted not to sell my email address to low-life spammers!) I ALWAYS make sure than any boxes allowing things like "affiliates" to send me "offers" - or even the company itself, in most cases is UNchecked when I buy anything or create any new accounts. I guess it depends on how much ordering you do online - but I'm inclined to keep it simple. You could choose an email address and use it for all online orders ONLY and that should do the trick. Remember too - you're more likely to have your CC number stolen in a bricks-and-mortar situation than you are to have it stolen online. Used online, absolutely - stolen online, far less likely. And the first notification about illicit use of your CC online or otherwise is often through your CC issuer, whose computers track usage patterns and flag anything out of the ordinary. I've found that my CC issuers - Bank of America up until 5 years ago when we moved, and TDCanadaTrust have been very good about this - to the point where we now, as recommended, let them know when we'll be out of the country so that we don't find ourselves with a blocked CC because the computer flagged the "unusual" usage. They called me the other day when the camp my son is going to this summer put through the charge 4 times, canceling all but one of the charges in the end, but it was a high dollar amount and they did the right thing, even though in the end, nothing was actually wrong. (There was some confusion about the transportation charge and I think they put it through with it on, then realized he was being picked up and took it off, and got the wrong amount, corrected that, and then finally got it right. )

Jim's idea about creating a mailbox for orders only is a good one - the trick will be figuring out what to use as the filter. Too general (ie: "order") and you're likely to get lots of spam in there too, if you get much spam. So simply setting up and using one email account only for online orders solves that issue.

IF you continue getting spam with AOL, dump it. It's likely that you've landed on some spammers' lists and you'll continue to get spam there. It's pretty hard to make it stop. Also, AOL's spam filters are utterly unsophisticated, unlike those at GMail and in Mail itself. I'm not sure why you're attached to it if you're not using it for anything important, as you stated earlier.

[LR827]

Jim, I very much appreciate all of your advice -- well worth more than 2c. Thank you for all your time and help every time. That said, I'm not quite sure where to start in answering Paddy and you. I want to tell you that I have collected credit cards over time, this or that offer over the years, but only use a few. At some point quite a few years ago I reached the point of recognition that it was not a good idea to open new accounts just to get an immediate discount.

I checked my Transunion credit report*, all 3 bureaus, and I'm okay right now. But I saw a half dozen old credit cards that are inactive, but not closed, and I'm closing them now.

Paddy, I don't understand why you don't find anything under Google about this. I CAN'T be the only victim of this -- even if it's an "experiment" -- they could not have pulled this off on someone unless they were using Bill Me Later, or another such site. I sent one email to SpamCop, but I have not heard anything from them.

The stream of spam to my aol account has petered out, now, although I plan to continue policing it closely. I CAN'T close it now or else I may miss another "Order" that may slip by -- even though BML has been alerted of the fraud and no other credit company seems to have been involved. As I said, I get computer alerts for any transaction on my other accounts.

There is actually somewhat of a fail-safe about the BML account that was compromised: It was an old account, with my old address and phone number. The mWave . com had already cancelled the order for the computer because they checked out the phone number. Overstock did not, so they put it through.    

Where to start with notifying anyone of the fraud? I have kept about a hundred of the emails. By the way, there is no way to set up a spam filter for them because the email have unrelated words and phrases, in the subject and text, taken from, I guess, books or websites all over the world. Not a word or phrase is repeated in any two (I would bet). I can upload one or more if you want to see.

I still don't know where to notify anyone about this, in terms of an agency that would actually have the capacity to investigate this sort of thing.

*Make sure everyone knows that "FreeCreditReport.com" is not free, nor is the Experian's own site, as they imply, nor any other site offering "free" credit reports-- The only legitimately free reporting site is www.annualcreditreport.com .

[Xairbusdriver]

QUOTE

there is no way to set up a spam filter for them because the email have unrelated words and phrases, in the subject and text, taken from, I guess, books or websites all over the world. Not a word or phrase is repeated in any two (I would bet). I can upload one or more if you want to see.

I think you're missing the point or perhaps you feel better qualified to spot SPAM than the computer.

In fact, you are better qualified! Unfortunately, you have experienced why it is not an efficient method; you simply don't always have the time AND it doesn't cut down on your time needs in the future. The kind of things that can help are called Bayesian analysis methods. It's a way of training the software by showing it specific messages that you consider SPAM (whether anyone else would is actually irrelevant!). This Bayesian analysis is just one of the methods used by SpamSieve (and most other good filtering apps). It does take time, if you get only a few SPAMs a week. Dumping several dozen of yours into SpamSieve might take much less time. But you'll never know unless you use it (or another similar app).

And, uploading more messages here won't help, either. First, you already know they're SPAM. Second, having anyone confirm it is not going to stop them from coming. Besides your credit card and Credit Report actions, your main frustrations, at least mine would be, is to stop these things. Since AOL provide next to nothing to help, your only practical option is to try an app or two. Of course, you can design and program your own app if you'd like. I just doubt you have the time for that. However, Xcode is free!

OT remarks follow:
BTW, you can get one free report from each of the three services. Most people suggest requesting a report every four months rotating the company so you never ask the same one for 12 months. You might also need to realize hat the report you get is not exactly the same as what some company might request from the three services. You may not even get your "Credit Score." As more incentive to close those unused cards, the credit limits on each of them counts toward your total credit limit, it could be hard to get a loan, for example, because you have the potential of several thousand dollars on those cards you don't even carry. Even closing them can lower your score! But the 'hit' from that will be much shorter lived than carrying around the potential loans from hose un-used cards.

One final word on cards; I have not yet seen anything to convince me that a Debit card has any redeeming features. But I know of many features that are not available with them that are standard with a real CC. But they are great for the banks, so they "encourage" everyone to have one (or more!).

[Paddy]

Lorraine, as Jim states, you're entitled by LAW to get a free credit report from each of the 3 credit bureaus every 12 months, depending on which state you live in. Illinois is one of the states.

www.annualcreditreport.com is used by all three reporting agencies - you can choose to receive all three at once or one at a time. The credit bureaus ARE somewhat sneaky in making you think you have to pay no matter what (particularly Experian, which doesn't seem to HAVE a link to the central source on their site, unlike the other two)

You could put a fraud alert on your credit report if you want to - it won't prevent fraud on your existing credit cards, but will prevent anyone with enough of your ID to open a new account from doing so without you hearing about it as I believe they must call you at your home phone number (the one listed at the credit bureau) in order to confirm that YOU really want to open the account. You cannot get "instant" store credit with a fraud alert on your account.

As for reporting the fraud, well, obviously to BML, which you've already done, but also to your local police. They may ask you to contact the police in the jurisdiction where the items were to be delivered as well, or they may contact them as part of their investigation. Or who knows...they may not want to do anything, since it was in fact only attempted fraud as it was stopped before anyone lost any $$. It really depends - a big city police force with a whole lot of real and serious crime to deal with may not be terribly interested. When I lived in North Andover and the same thing happened to me (with  a credit card though) the North Andover police took a report and they also asked me to contact the precinct in NYC where the cameras were supposed to be delivered. (That was in part because the officer in NA who I was dealing with was technologically illiterate and couldn't figure out how to send a fax to the NYC police! This was about 12 years ago...I hope he's gotten help since... ) I had a nice chat with one of the two detectives in the precinct working on nothing but CC fraud; they were already watching the Mailboxes Etc. outlet that was the delivery address for the fraudulently ordered camera. Whether my report helped them in any way, I don't know - really all it could have done was confirm what they already knew or suspected.

[dboh]

QUOTE(Paddy @ Apr 24 2012, 11:38 AM) <{POST_SNAPBACK}>

www.annualcreditreport.com is used by all three reporting agencies - you can choose to receive all three at once or one at a time. The credit bureaus ARE somewhat sneaky in making you think you have to pay no matter what (particularly Experian, which doesn't seem to HAVE a link to the central source on their site, unlike the other two)

I've used annualcreditreport.com every year since it started, most recently a couple of weeks ago. I noticed a lot less of that sneakiness this time around. All three CBR sites were clearly marked for the free report, and it took fewer "clicks" to get to the actual report. I wonder if that was a result of Dodd-Frank.

[Xairbusdriver]

Occasionally, and often only by accident, good things do come from Congress. OTOH, your experience in knowing where to look for the "fine print" may give you an advantage that newcomers lack. I older I get, the less I trust most sources to "give" me all the facts.