DEBIT ORDER PROCESSED

[Previous Example] [Share This Page] [Back To The Main SHPAMEE Index] [Next Example]

VERY IMPORTANT INFORMATION, READ THIS FIRST: The example and associated information published on this page are subject to the SHPAMEE Terms Of Use. Please familiarise yourself with these terms before viewing or using any information on this page.

Header:

From - Thu Oct 4 18:16:32 2012
X-Account-Key: account2
X-UIDL: x
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
X-Apparently-To: x via 212.82.111.163; Thu, 04 Oct 2012 04:39:58 +0000
X-YahooFilteredBulk: 79.124.76.36
Received-SPF: none (domain of qrypto.gotobg.net does not designate permitted sender hosts)
X-YMailISG: x
X-Originating-IP: [79.124.76.36]
Authentication-Results: mta1001.mail.ird.yahoo.com from=qrypto.gotobg.net; domainkeys=neutral (no sig);
from=qrypto.gotobg.net; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO qrypto.gotobg.net) (79.124.76.36)
by mta1001.mail.ird.yahoo.com with SMTP; Thu, 04 Oct 2012 04:39:58 +0000
Received: from zaslivi by qrypto.gotobg.net with local (Exim 4.77)
        (envelope-from <zaslivi@qrypto.gotobg.net>)
        id 1TJdE5-00051X-FG
        for x; Thu, 04 Oct 2012 07:39:57 +0300
To: x
Subject: DEBIT ORDER PROCESSED
X-PHP-Script: eurochrom.eu/wp-includes/images/smilies/eri.php for 41.220.69.96
From: ABSA <absa4@qrypto.gotobg.net>
Reply-To:
MIME-Version: 1.0
Content-Type: text/html
Content-Transfer-Encoding: 8bit
Message-Id: <x@qrypto.gotobg.net>
Date: Thu, 04 Oct 2012 07:39:57 +0300
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - qrypto.gotobg.net
X-AntiAbuse: Original Domain - yahoo.co.uk
X-AntiAbuse: Originator/Caller UID/GID - [32388 32391] / [47 12]
X-AntiAbuse: Sender Address Domain - qrypto.gotobg.net

Body:

Dear Customer,

A debit order for life insurance from Liberty Life was placed on your account this morning and we have been instructed to deduct R1870 from your account today

If you don't want to authorize this debit order, please click here to Login and follow subsequent steps carefully.

Regards,
Security Department

Comments:

This scammer did not even make an effort to make the scam look a little bit more legit. Just shows you how low they rate their victims. ABSA would never send you an e-mail looking like this.

But apart from the lousy formatting and appearance of this e-mail, the content is pretty ridiculous as well. The bank can't send you an e-mail to "un-authorize" a debit order, it simply doesn't work that way.

A debit order is normally a written agreement (sometimes verbal) between you and a 3rd party where you give the bank instruction to pay the 3rd party a certain amount on a monthly basis. In other words, the authorization is always given upfront and not on the day when the bank processes that debit order.

A debit order ALWAYS work on an opt-in basis and not opt-out.

But the simple rule of thumb always applies to e-mails like this, whether you know how a debit order works or not, the bank will NEVER send you an e-mail for some form of authorization or verification purpose.

Related Cyber Criminal Profiles:

No related profiles found.

Similar Spam Examples:

Standard Bank Phishing Scam - Debit Order Authorization
ABSA Bank Phishing Scam - Authorized EFT Payment Received
ABSA Banking Phishing Scam - 2012 - SARS PAYMENTS
ABSA Excess Charges Refund Banking Phishing Scam
Banking Phishing Scam - Important Message from ABSA

Related Malware Samples:

No related malware samples found.

[Previous Example] [Share This Page] [Back To The Main SHPAMEE Index] [Next Example]