Author Topic: New Scam Or Bad Advert  (Read 13213 times)

Offline jepinto

  • TS Addict
  • *****
  • Posts: 6195
    • View Profile
    • http://
New Scam Or Bad Advert
« on: December 23, 2003, 05:46:23 AM »
What do you think?
QUOTE
Dear Customer,

Our latest security system will help you to avoid possible fraud actions and keep your investments in safety.

Due to technical security update you have to reactivate your account

Click on the link below to login to your updated Visa account.

To log into your account, please visit the Visa Website at

http://www.visa.com

We respect your time and business.  It's our pleasure to serve you.

Please don't reply to this email. This e-mail was generated by a mail handling system.

Copyright 1996-2003, Visa International Service Association. All rights reserved.


The url looks becomes
QUOTE
http://www.visa.com <http://www.visa.com
:UserSession=2f6q9uuu88312264trzzz55884495&
usersoption=SecurityUpdate&StateLevel=GetFrom@205.243.144.83/~gotierc/verified_by_visa.htm>
« Last Edit: December 23, 2003, 07:02:59 AM by jepinto »
Do not fear your enemies.  The worse they can do is kill you.  Do not fear friends.  At worst, they may betray you.
Fear those who do not care; they neither kill nor betray, but betrayal and murder exist because of their silent consent.
~Bruno Jasienski~

Offline pendragon

  • TS Addict
  • *****
  • Posts: 7178
    • View Profile
    • http://www.pendragonservices.com
New Scam Or Bad Advert
« Reply #1 on: December 23, 2003, 07:20:05 AM »
Sounds like  a scam to me. But you may care to call your bank or issuer/servicer of your card just to check...

Harv
Those who can make you believe absurdities can make you commit atrocities. ~ Voltaire

Offline Highmac

  • Administrator
  • TS Addict
  • *****
  • Posts: 5455
    • View Profile
New Scam Or Bad Advert
« Reply #2 on: December 23, 2003, 07:22:20 AM »
Jennie - I'd be very suspicious. Doing a Google on "Visa card" certainly comes up with www.visa.com/ but it goes straight into "globalgateway etc... " and asks for "your region". Clicking on the link in your message came up with a "not found" - -perhaps somebody's already pulled it.

These things are so annoying. I got an email from my own ISP and didn't believe it. Their homepage confirmed they were sending the emails about changes in conditions. From the Visa corporate website
QUOTE
As the most used payment card, Visa takes security very seriously. Visa has highly sophisticated fraud screening solutions in place, which are enhanced in collaboration with technology companies every day. If you suspect fraud, please contact the financial institution (bank) that issued your Visa card. You can contact them directly, using the address or telephone number on your Visa statement or on the back of your card.
« Last Edit: December 23, 2003, 07:27:46 AM by Highmac »
Neil
MacMini (2018) OS10.14.6 (Mojave). Monitor: LG 27in 4K Ultra HD LED.
15in MacBook Pro (Mid 2014) OS10.13.4 (High Sierra);
15in MacBook Pro (2010), (ex-Snow Leopard); now OS10.13.6 (High Sierra); 500GB Solid-State SATA drive; 4GB memory.

Offline RHPConsult

  • TS Addict
  • Posts: 7859
    • View Profile
    • http://
New Scam Or Bad Advert
« Reply #3 on: December 23, 2003, 09:27:54 AM »
If it's r-e-a-l, then it's also  dumb- -D-U-M-B- -D-U-M-B, since it looks soooo suspicious . . . these days. (A quick check of my reported financially-oriented e-scam messages discloses 32 in the past 6 weeks, alone!)

I followed some of your links, Jen, and got this . . .
Here

So I'd do just they (and HighMac) assert and check your particular bank. Plus I'd demand an explanation of their internet stupidity, if that's what this turns out to be.

Gotta give somebody credit, if this is a scam: Someone surely worked hard to make it appear legit. If not, then the post pubescent youth in marketing who thought up this approach and "sold it", as well as the superiors who "bought" it, ought to lose their keys to the washroom for an indeterminant period. harhar.gif

Offline Epaminondas

  • TS Addict
  • *****
  • Posts: 1247
    • View Profile
New Scam Or Bad Advert
« Reply #4 on: December 23, 2003, 09:46:35 AM »
If is is legitimate, they have managed to model it directly on how scams are done.

I.e. - it looks like a scam until proven otherwise.


I suggest against using the url provided in the email.

You might type www.visa.com directly in your browser and check the Visa web site out directly.

I would be happy to help you further in this matter but I will first need your Visa account number, account balance, social security number, address, date of birth, height and weight,  favourite Broadway musical, number and placement of your dental cavities and of course, your mother's maiden name . . .


Take care -

Epaminondas


URL spoofing flaw could be used in bank scams

Offline jepinto

  • TS Addict
  • *****
  • Posts: 6195
    • View Profile
    • http://
New Scam Or Bad Advert
« Reply #5 on: December 23, 2003, 01:39:00 PM »
Well, get a 404 now, so might have been a scam, or they might have realized just how badly that was written.

This is what comes up now.

http://www.usa.visa.com/personal/cards/acc...=h2_/index.html

hmmmm....wonder what REALLY happened.
Do not fear your enemies.  The worse they can do is kill you.  Do not fear friends.  At worst, they may betray you.
Fear those who do not care; they neither kill nor betray, but betrayal and murder exist because of their silent consent.
~Bruno Jasienski~

Offline krissel

  • Administrator
  • TS Addict
  • *****
  • Posts: 14735
    • View Profile
New Scam Or Bad Advert
« Reply #6 on: December 23, 2003, 11:50:58 PM »
Clicking on the first link in Jennie's post brings you to the global portal for Visa which eventually takes you to a secure page if you click through the "Secure Visa" portion.

It does look legit but at the same time I agree that it also is too much like the typical scams you get everyday. Yes, the idiot at Visa who OKed this should be taken out and given a few zaps with a cattle prod.

You should never have to "reactivate" your account via this method, how does the bank know you even have a computer? There has to be some snail mail contact if there is some sort of problem with your account.

What I think they are trying to do if this is legitimate is to make you aware of what some of the credit companies are offering these days. That is a method of making your online purchases more secure. Visa has chosen to give you a special password that you would use when shopping at certain sites. Mastercard has a procedure that automatically issues a temporary card number for your online purchase so your actual number is not used. These features are something you do have to sign up for but usually through your bank's online site not through the main card site.

Do check with the bank that issued your card for confirmation before putting your number into any of those blanks. I would also try to contact Visa and see if they have any info on any online scams. I had one recently from CitiBank that was similar but since I'm not a customer I knew immediately that it was bogus.
 wacko.gif

One thing I tried, I put in the beginning of my Visa number (the first four digits which identifies it as Visa) but then made up the rest of the numbers. In the two places that I found to enter such info (here for example) I got a popup immediately that it wasn't a valid number and the page did not change.
If this was a fake site, how would they know the number was phoney?


A Techsurvivors founder

Offline Diana

  • Super Poster
  • ***
  • Posts: 410
    • View Profile
New Scam Or Bad Advert
« Reply #7 on: December 24, 2003, 10:08:05 AM »
First and foremost..Jennie's e-mail was a scam. I have to state that because all the nice people here are alluding to a "benefit of the doubt". On the internet, there should be no benefit of the doubt. Epaminodas is right...if you don't know without any doubt, assume a scam.

Krissel is also right about the new VISA and Mastercard verification system. They are in the process (it's not totally new) of trying to set up a system where merchants can verify the  users right to present a card for payment. One way some sites do this is to ask for the 3-4 character number on the back of the card. Supposedly giving this number proves that you have it "in hand" and are not just reading from a stolen receipt or some other method that doesn't require the actual card.

The new method is one where each card holder signs up with their card issuer to agree to put in a userID and password whenever asked to by a participating merchant. I've investigated this at MBNA and it bothers me somewhat. MBNA tells me it's ok to put in my MBNA userID and password whenever I see the popup window as produced by a participating merchant. I don't like this at all. How do we verify that the popup is legitimate? and where does that info go?..to the merchant who should never be privy to that information?...There are other backend methods that verify a card's status without needing my personal information. I'm told that the info goes to a third party computer somewhere. When VISA says third-party, they don't say "MBNA" and MBNA is the only party who needs to know my userID and password..and then only to access their site...not to buy some item. MBNA also states that not all merchants are participating and that it's ok to shop at the ones who don't..all fraud guarantees will still apply. So what's the point? I haven't run into a participating merchant yet, so I don't know what will happen if Mozilla blocks that popup. I wonder if my purchase will still go through. To end this, let me say, the purpose again is the verify a card during an actual purchase process. This will NEVER be used to verify an account just to be verifying some account. Only participating MERCHANTS will be presenting this popup..(and I still don't like it..smile.gif )

Now that I've touched on that, let me say again. Jennie's email was a scam. Note in the long URL where there appears an @ sign. Anything in front of that @ sign is treated as account information. Only what comes after is treated as a domain. The IP number belongs to a company called xnet.com. They provide user dialup and hosting accounts to individuals. Note further the ~gotierc portion. That is the stupid user who pays for an account with xnet.com. When was the last time you shopped at a merchant who had a ~ in their URL?

Let's teach people that these are scams pure and simple. There is no doubt. NEVER EVER click one of those links. Use the "view source" options in your e-mail program to look at any links to see if they are obfuscated. In fact, if at all possible, disable the "view as HTML" option in your e-mail program...that will open up a ton of tricks, unveiling many scams.

*ok I say to myself* "lighten up..it's almost Christmas"  *grin. Please take care and don't fall for any of these things. The Internet is not a nice place although it's frequented by the nicest of people...TS being best...smile.gif

Have a very Merry Christmas and a Happy New Year to all.

see ya,
Diana
Sysadmin Rule #14: If it's not on fire, it's a software issue.

Registered Linux user 290473
http://counter.li.org/
http://www.crestcomm.com/diana/gnupg.txt for GnuPG public key  

Offline RHPConsult

  • TS Addict
  • Posts: 7859
    • View Profile
    • http://
New Scam Or Bad Advert
« Reply #8 on: December 24, 2003, 12:40:46 PM »
Thanks, Diana.  I doubt if I'll ever really understand how competently to read "headers' , but your description was interesting. If you'd care to 1) elaborate on it, or 2) suggest an elementary reference to enhance one's knowledge of the "subject", I for one would appreciate it.

Perhaps someone could write a brief essay on Recognizing Internet Scams: Hints for the Amateur Computer User. I worry about especially naive elderly users who can get sucked in to what these scumbags are doing every day on the net.



Jennie:

If you get anything but boilerplate from your bank, in response to any inquiry/complaint you lodge, it would be interesting to see it.



In a somewhat related matter, my detailed complaint to United Airlines (posted here a few weeks ago - - The thread) asking why (at least some) Mac owners are frozen out of its heavily promoted "On-Line-Check-In" process, produced only a very disappointing "bedbug" letter, with no explanation . As a multi-million-mile UAL flyer, all I got back was a "Thank you for bringing to our attention . . ." dodge.


NOT satisfactory!
« Last Edit: December 24, 2003, 03:07:50 PM by RHPConsult »

Offline Xairbusdriver

  • Administrator
  • TS Addict
  • *****
  • Posts: 26388
  • 27" iMac (mid-17), Big Sur, Mac mini, Catalina
    • View Profile
    • Mid-South Weather
New Scam Or Bad Advert
« Reply #9 on: December 24, 2003, 04:30:07 PM »
Best and most direct advice I've seen about 'trust' and 'e-mail.' Those two terms don't usually belong together! biggrin.gif  The suggestion to view source is also good, much easier than trying to interpret the headers, also. But the better solution is disabling the HTML method, if possible. Remember Tacit's warning about invisible images that you may not even notice when viewing an HTML message. Just viewing it has sent your address back to the SPAMMER/SCAMMER, even if there is no 'link' for you to click.

Of course, my much recommended POPmonitor will also allow you to view messages without having to worry about what might be in  it. You can also filter for "<img" and look at what is there and who is sending it.

As for the obfuscation, this is what many recommend when putting your e-mail address in a web page. It is usually a simple swap of the ASCII code for a letter/number with the appropriate simple and a semi-colon at the end: My Name=My name
But there are other methods/symbols/codes that work just as well. That's what the this 'author' did. The HTML engine interprets the code and displays the correct letter. This was originally a method of displaying letters/symbols that were used in creating HTML 'code.' The most used symbols being "<" and ">" which wraps every line of HTML. But it is also recommended when you want to use 'curly' quotes and such.

Diana's point remains valid, however. If you see these things in an e-mail, trash it immediately! If a vendor needs to include his URL in a message, there is absolutely no need to obfuscate it. It is not for his nor your protection. I read a message in POPmonitor just yesterday that claimed to be from e-bay. I think it priobably is because there is no request for any info, just a request to visit their site with a URL. However, I would still use a bookmark to visit the site rather than anything included in an e-mail. Sites can be downloaded/copied/uploaded/faked/etc. So a 'new' url you get in an e-mail may still not take you to the actual companies site.

There seem to be an endless supply of 'grinches' out there just waiting to welcome you into their sites! Tread with care, every where! whew.gif
« Last Edit: December 24, 2003, 04:33:10 PM by airbusdriver »
THERE ARE TWO TYPES OF COUNTRIES
Those that use metric = #1 Measurement system
And the United States = The Banana system
CAUTION! Childhood vaccinations cause adults! :yes:

Offline tacit

  • TS Addict
  • *****
  • Posts: 1628
    • View Profile
    • http://www.xeromag.com/
New Scam Or Bad Advert
« Reply #10 on: December 26, 2003, 06:12:29 PM »
It is a fraud. It does not go to visa.com. This is one of the oldest tricks in the spammer's book.

Look very closely at the URL. Do you see the @ sign in it?

The @ sign has a special meaning in a URL. It indicates a "user name." The purpose of this is to be able to include usernames and passwords into special secure Web addresses that require a username and a password.

In practice, if there is a @ sign in a URL, everything to its left is chopped off. The URL in your email is not visa.com. The URL is http://205.243.144.83/~gotierc/verified_by_visa.htm.

Any time you see a @ in any URL, chop off the @ and everything to its left. For example:

http://www.yahoo.com:yahoospecials@xeromag.com

is NOT a Yahoo.com URL. It's a xeromag.com URL.

Sometimes, spammers will "hide" the @ sign in a URL by using its special percent code, which is %40. So, for example:

http://www.yahoo.com%40xeromag.com

is not a Yahoo.com address, it is a xeromag.com address. (There is a paypal scammer who steals PayPal usernames and passwords by creating very long, complicated URLs that contain many % codes; at the very end is a %40 and the fraud artist's real address.

Your Visa email is what's called a "phishing email" in security jargon. A phisher is someone who uses emails like the one you received to steal credit card numbers. A typical phisher can usually steal thousands of credit card numbers in the first hour or so after the email goes out. The phisher, who is usually a member of organizedc crime or someone in a country like Yugoslavia or Russia, then maxes out all the credit cards by placing hundreds of orders online. All the goods purchased are sent out of the country, usually to Eastern Europe, where the recipients sell the goods on the street and send the money back to the organized crime members responsible.

Phishers will also sometimes get jobs as gas station attendants or in retail stores. They'll work for a few weeks, during which time they secretly record all the credit cards used by customers, then quit the jobs and max out all the credit cards. (I had this happen to me when I used a credit card to buy new tires; the person working at the tire store stole the credit card number, and maxed it out buying things on line which were sent to a city in Yugoslavia. The security person I spoke to at my credit card company said this scam is run almost entirely by the New Jersey Mafia.)
A whole lot about me: www.xeromag.com/franklin.html

Offline Paddy

  • Administrator
  • TS Addict
  • *****
  • Posts: 13797
    • View Profile
    • https://www.paddyduncan.com
New Scam Or Bad Advert
« Reply #11 on: December 26, 2003, 08:39:10 PM »
I would like to second (third?) Diana's and Tacit's comments - credit card companies, Paypal, eBay and the like DO NOT, in my experience ask you to "reconfirm", "reregister" "reactivate" or anything else online, via an email sent to your email address. If your credit card company has issues with you or your account you'll be hearing from them by phone (in the case of suspected fraud on your credit card account) or via snail mail.

Some info on various scams and how to spot them/avoid them

AOL/Phishing scam
FTC's "How Not to Get Hooked by a 'Phishing' Scam
FBI Alert about debit card scam

EBay's Fraud Info page
MBNA/eBay credit card offer info

I have twice in the recent past been victim of credit card fraud - the first (and isolated instance) involved a gas station attendant or employee, who not only stole my credit card number and but was dumb enough to use it at the same gas station. Since I live in MA and the gas station was one I went to exactly ONCE in Scarborough, Ontario, 6 months earlier, it was pretty easy to identify the source of the fraud. He/she also used it once more at a restaurant. I reported it to the Metropolitan Toronto police, but doubt they ever did a thing about it - it's small potatoes in their books. The second incident was also easily traceable, and I did all the "detective" work - the police here in North Andover just plain plumb aren't experienced enough in this sort of fraud. I had used my credit card, online, to order checks for our school PTO. They were delivered to the school, rather than to my address. This was the only time that this credit card was used with this address. I got two calls from online camera dealers to verify that I had "ordered" expensive digital cameras - with the school's address used as my home address. The cameras, of course, were to be delivered elsewhere - a Mailboxes Etc. in midtown Manhattan that the NYC police were already watching. I talked to the NYC police detective and he told me that much of the credit card fraud of this sort was being conducted by the NY & NJ Russian mafia. My last call was to the company where I had ordered the checks - to alert them to the fact that they had someone on staff who was obviously stealing credit card numbers. The first person I spoke to put me through to their billing department. Of course, the man I spoke to there denied any possibility of wrongdoing in his company. And guess what sort of an accent he had?

I gave all the information I'd gathered to both the police here and the NYC police - not sure if anyone was ever caught as a result, but at least I tried! The other fraudulent charges on my card were for online porn - when I called to have those charges reversed, the woman in the billing department told me that they get this sort of thing all the time!

This is all part of the huge upsurge in identity theft of all kinds, much of it enabled by the internet, though rarely perpetrated by the employees of legitimate online businesses. This is where people get confused, I find - many people, including my mother, are afraid of shopping online - not realizing that the fraud they read about is NOT generally as a result of shopping at legitimate, well-established online businesses with excellent security systems. The online fraud happens AFTER the thieves have obtained your credit card number - usually through methods which have nothing to do with your shopping, and may be as primitive as stealing your mail from your mailbox - after which they have a field day buying things online at your expense, using your credit card number.

After having my wallet stolen a couple of years ago, I had a fraud alert placed on my credit reports, which prevents anyone (including me) for applying for instant credit. All credit applications must be confirmed by me at my home phone number. In looking up the availability of this option, I discovered that my alert may have expired, but it is something worth considering to help prevent identity theft.

http://www.fightidentitytheft.com/flag.html
"If computers get too powerful, we can organize them into committees. That'll do them in." ~Author unknown •iMac 5K, 27" 3.6Ghz i9 (2019) • 16" M1 MBP(2021) • 9.7" iPad Pro • iPhone 13

Offline RHPConsult

  • TS Addict
  • Posts: 7859
    • View Profile
    • http://
New Scam Or Bad Advert
« Reply #12 on: December 27, 2003, 07:40:08 AM »
Wonderfully helpful summaries, Paddy and Tacit. I learned a lot.

Thanks.

My only experience with an "executed" fraud w/a stolen number was a charge for 4 fill-ups at the same gas station, on the same day, in downtown SF, plus a $3200 "lunch" at Ming's Diner, a hemi-hole in the wall eatery in Chinatown.

Easy to refute, but I always doubted that anyone got caught.

The real disappointment I felt was with my now "former" cc company that maintained no trigger to catch such blatant fraud,  and then, after I detected it, consumed 4 weeks to accept my "explanation", despite a forged signature on the purported receipt.

  mad.gif
« Last Edit: December 27, 2003, 10:47:06 AM by RHPConsult »

Offline jepinto

  • TS Addict
  • *****
  • Posts: 6195
    • View Profile
    • http://
New Scam Or Bad Advert
« Reply #13 on: December 27, 2003, 09:08:34 AM »
I must say that "whoever" is in charge of things acted fast.  The site was closed down the same day.

But, the "phisher" wasn't too bright...or sumtin.  The page did not have an easy way to plug in the info he/she wanted.  (Yes, I had turned off cookies, afore I went a vistin')
Do not fear your enemies.  The worse they can do is kill you.  Do not fear friends.  At worst, they may betray you.
Fear those who do not care; they neither kill nor betray, but betrayal and murder exist because of their silent consent.
~Bruno Jasienski~

Offline tacit

  • TS Addict
  • *****
  • Posts: 1628
    • View Profile
    • http://www.xeromag.com/
New Scam Or Bad Advert
« Reply #14 on: December 27, 2003, 04:18:36 PM »
QUOTE(RHPConsult @ Dec 27 2003, 1:40 PM)
The real disappointment I felt was with my now "former" cc company that maintained no trigger to catch such blatant fraud,  and then, after I detected it, consumed 4 weeks to accept my "explanation", despite a forged signature on the purported receipt.

 Card-issuing banks don't want to end credit-card fraud; it's a huge source of profit for them.

Whenever someone charges something fraudulently on your card, and you file a complaint, the issuing bank credits you with the amount fraudulently taken, often less $50. They do not absorb this cost, though; they take the money out of the merchant account of the store where the card was used...and charge the merchant an additional $50 "chargeback fee." The merchant loses twice--he has lost the goods or service,and he's also lost the money and an additional $50 besides.

These $50 chargeback fees add up quickly, and together put tens of millions of dollars into the coffers of the issuing banks. In fact, from the point of view of the bank, the best possible world would be one where every customer had his card stolen and maxed out once a year; if that happened, the banks would make more money from chargeback fees than from interest and merchant fees combined.

Last year, a group of merchants filed a class-action lawsuit against the major credit comanies over the chargeback fees, arguing that they amount to extortion, and that the credit issuing companies deliberately do not take action against many credit card scammers. I don't know what the current status of that lawsuit is.
A whole lot about me: www.xeromag.com/franklin.html