How to spot a credit card phishing email - Fake Amazon Prime email

[trs96]

Just got this in my inbox today. I knew it was fake from the subject line since I didn't try to pay for Amazon Prime. The other big clue was that it came to an email address I've never used with Amazon.

Some people that do get this may have just bought AMZ Prime (They send out tens of millions of these every day) some people fall for it.

1. First clue it's fake. They address you as "Dear Customer" instead of using your name.
2. Poor grammar. "The charge for your membership was decline." It should say payment was declined.
3. Huge Update Payment button. Amazon never does anything like this in an email. They'd never have you click an email link to do the update.

The authors of this email are just trying to get your Credit Card number and then run up charges on it.
If you're still not convinced it's fake, look at the email address of the sender. That is definitely made up.

fixissueuser-paymentmanager@beautyaccories.onmicrosoft.com

Doesn't really look like something Amazon would use for an email to a customer.

 

[wstrohm]

Not phishing, but just received a CitiCard statement with 4 instances totaling $2100 of charges from "HBF" in Yakima, WA. ("Hurst Berry Farms?") All bogus; our MasterCard is cancelled and a new one will be issued. Have no idea where this happened... Started around July 1, apparently. Maybe a restaurant copied front & rear of our card and went from there?

 

[imjessica]

Just got this in my inbox today. I knew it was fake from the subject line since I didn't try to pay for Amazon Prime. The other big clue was that it came to an email address I've never used with Amazon.

Some people that do get this may have just bought AMZ Prime (They send out tens of millions of these every day) some people fall for it.

1. First clue it's fake. They address you as "Dear Customer" instead of using your name.
2. Poor grammar. "The charge for your membership was decline." It should say payment was declined.
3. Huge Update Payment button. Amazon never does anything like this in an email. They'd never have you click an email link to do the update.

View attachment 527291
The authors of this email are just trying to get your Credit Card or PayPal payment number and then run up charges on it.
If you're still not convinced it's fake, look at the email address of the sender. That is definitely made up.

fixissueuser-paymentmanager@beautyaccories.onmicrosoft.com

Doesn't really look like something Amazon would use for an email to a customer.
View attachment 527292

When my bank contacted, I asked them to tell me my date of birth. They claimed they couldn't prove who they were and advised me to phone the number on the back of my card and ask to speak with the fraud department.

It was so tempting to just believe them because, after all, scammers wouldn't do that, would they? But I hung up and dialed the number for my bank. The call was authentic, but I just had to do it since it's stupid to trust someone who calls you and claims to be your bank.

 

[FormerUser-400995]

Doesn't really look like something Amazon would use for an email to a customer.

Yup, easy enough for the trained eye to spot.

According to my text-message spam scam logs over the last month, I should have received multiple packages by now via UDL (I won't hold my breath). Of course, each message had an obfuscated web address to click for further information...

 

[trs96]

Here's another fake phishing email. They pretend to be Microsoft and say that someone got into my email acct.

Well, MS would actually have my correct email in the body of the letter, which this didn't. They didn't even have my email in the To: field. It's as phony as a nine dollar bill. It would at least address me by my actual first and last name if it really were from MS.

 

[MacMan]

Here's another fake phishing email. They pretend to be Microsoft and say that someone got into my email acct.

Well, MS would actually have my correct email in the body of the letter, which this didn't. They didn't even have my email in the To: field. It's as phony as a nine dollar bill. It would at least address me by my actual first and last name if it really were from MS.

View attachment 538866

The best way to spot these is to look at the raw message source.

Here is an example of a SPAM email my mail server blocked from LinkedIn (as seen in Thunderbird):

The key fields to look at in the raw source is:

From: LinkedIn <[email protected]>
Subject: You appeared in 7 search this week

Received: from server5.webhostbd.net (server5.webhostbd.net [23.29.122.170])

First clue it's phishing, Thunderbird only showed us the friendly name "LinkedIn". But in the raw source you can see the real source email address is <[email protected]>.

The second is when you do a whois for the Received from host 23.29.122.170. You'll see the host is on HIVELOCITY's network. Well LinkedIn is owned by Microsoft so why would they be using a third party hosting provider.

The third thing to look at is the links in the message. If the link is shortened like http://goo.gl/GG9FGT and checked on http://checkshorturl.com you'll see in this case the actual URL is http://bizzzup.info/wp-content/plugins/rajce-embed/rnb_p3_5.php?36474211 9220168935701. You should never click that link.

There are other things you can look at, but these two are the most obvious signs.