Here at VeriSign, our email filtering is pretty effective. We have a corporate solution run by Postini (Google) that I am sure processes an amazing amount of SPAM for us. In most cases, one email that I would consider truly SPAM might slip through every couple of months. Not a bad track record.
Today one of those messages got through, and I was amazed at what the bad guys doing to try and commit fraud nowadays. I remember several years ago that one effective method to get money out of large corporations was to just send an invoice for a small amount to the Accounts Payable department. Somewhere in the next two months, a check for that amount would show up in your mailbox.
As corporations tracked invoices more closely, these holes closed up and the bad guys had to get more creative. They started going after individuals through phishing and other types of con games. An acquaintance of my wife got suckered into one of those a few years ago when she sent cash to a company she got an email from claiming to fix credit problems.
The message today was someone claiming to be a professor, and their title being "Head Payment Commission." The interesting thing here was that instead of an invoice, this SPAM apologizes for paying late! It includes a bank reference and a bogus bank account, with a set of questions that I would need to answer to get paid. Aside from the obvious grammar issues and OverUse Of Studly Capital Letters on Common Nouns Like "Wrong Account," they ask you to re-confirm the payment details to make sure that payment can be rushed. Here's what they are asking for.
- Your Full Name:
- Phone, Fax And Mobile No:
- Company Name, Position And Address:
- Profession, Age And Marital Status:
- Working Id? D/Int?l Passport:
Note the bold underlines. I certainly cannot remember seeing anything like that on any supplier form I have either sent out or filled out. This is definitely something that smells like classic social engineering. Most social engineers would be a little more sneaky and only ask one or two of those types of questions among legitimate questions. They would then finish with a legitimate one or two to bury the one that should set the alarm bells off.
It's pretty ingenious, but nothing new. Bad guys have been doing this for years, and I would see this as nothing more than a smarter version of the Nigeria scams. We all know that stuff like this works, especially on people that are too trusting.
If it didn't work, it would not have shown up in my Inbox anyway.
