From: Quieta Guglione <oneidacarlisehizedo77@gmail.com> (note the name and email don’t match)
Subject: Thank You For Your Order! 94706540818423
Body of email:
Hey there!
Your satisfaction motivates us to produce work of the highest caliber. We really appreciate your confidence and promise to go above and above.
Your INV: CVWLREFNUCOCTDK/486389/6279305/L984MO4
Quieta Buglione
The attachment is a pdf file that is supposed to look like an official Microsoft invoice.
And of course, it if for an exorbitant sum of $659.99 and contains a toll-free number for you to call.
The number is +1 (833) 846-0573
Calling this will greatly complicate your life.
Don’t do it!
February 7, 2023:
Pathetic McAfee Membership Scam
Subject: Network Services#76812932
From: Laura Edwards <maryamelia8257@gmail.com>
To: My computer consulting email address
Body of message:
Date: 07 February, 2023
Registered Email : mine Reference ID: #33480409MS
Membership Update
Hello User,
We value your decision to choose McAfee Total and your assistance in getting us this far.
Your annual subscription to the network and device protection services has been renewed for ($329.99).
If you don’t stop or lower the charges, the same recurring fee will be collected from the updated payment source again the following year.
The yearly fee is withdrawn from the updated account credit balance, which will appear on your bill between 4 To 24 hours after it is updated.
If you wish to stop automatic debit and cancel all the charges, Contact Helpdesk +1 808 649 1377
In order to upgrade or change the term plan please contact us within 24 hours to avoid future charges.
Best regards,
Laura Edwards Services From McAfee Online Toll-free :+1 808 649 1377
Note that the name of the person contacting you does not match the name in the email address: She says her name is Laura Edwards. The email address indicates it is from Mary Amelia. This is always a giveaway to a scam.
This is what the email actually looks like.
No company logo and not addressing the recipient by name.
The bare minimum effort was put into this phishing scam.
McAfee-Scam-2-7-23McAfee-Scam-2-7-23
February 6, 2023:
Facebook Business Page Restriction Scam:
I am enclosing two examples of the same scam. One from email and the other from Facebook Messenger / Notifications.
It should be incredibly obvious this is a scam by the amateurish attempt made to ensnare the distracted Facebookian (I just made that up).
Clicking on any of the live links in either version will ruin your day, taking you to the tribelio.page site.
The first is purportedly from DHL – and I received 3 of these. Any time you receive multiple emails from any source, you can be fairly certain they are scams.
To: In this case the email went to an address not associated with our Amazon account. Always the giveaway that it’s a scam.
Once again…
<just one look at that email should be enough to delete the message>
The email has no Amazon logo, does not address you personally and is far to brief to be legit from any company.
Dear Customer,
“Your Amazon Prime Membership is set to renew on Friday, January 27, 2023. However, We’ve noticed that the card associated with your Prime membership is no longer valid. To update the default card or choose a new one for your membership, please usethis linkor click on the button below and follow the on-screen instructions. To prevent interruption of your benefits, we will try charging other active cards associated with your Amazon account if we can’t charge your default card, your Amazon Prime benefits will be suspended.”
The pdf attachment is the payload in this case.
Clicking on ANY link in the pdf file will take you to an infected file at qrco.de – a site in Germany.
Amazon-Prime-Scam
January 11, 2023:
Russian Corel Software Copyright Scam:
This pathetic attempt at extortion is just plain sad.
This idiot in Moscow thinks he will get me to give him money to not attack my Instagram account.
Nice try Komrade. I reported this domain to the registrar about 3 minutes after telling the scammer to go to Hell.
In the image below, the top section is the email I received.
Below that is the WHOIS report for this domain. It is registered and hosted in Russia, so going to the registrar’s website, I filed an abuse report and this scammer is going to have to start all over again.
Apple Purchase Scam:
This one purports to come from Apple and has the following:
Subject: Re: Billing Confirmation – Your latest order is being processed and will be paid automatically on Date: 11/01/2023
<The fact that the date field is NOT what a US company would use is a clue this is fake.>
<That should tell you right away it is fake. It should be coming from an apple.com address.>
Salutation: Dear customer,
<Any legit communication will have your full name.>
And the body verbiage is just wrong.
Then there is the PDF attachment – which of course has links for you to dispute the charge. Needless to say, clicking on one of these will ruin your day.
See images below:
Apple-Email-Scam
Apple-Receipt-Scam
January 9, 2023
Today’s ridiculous McAfee scam email comes from Donny M. Likens (oh sure…)
Subject: Membership Details>>>687484
To: my actual email address but not my actual name
Body:
1-9-23-McAfee-Scam
They’ve done a pretty decent job on grammar and sentence structure, but you would never see a legitimate email like this without the company logo. It would also never be center justified.
There would always be a signature block at the end with legitimate company contact information.
And… The salutation would NEVER be: “Hey Existing Client”. Never.
So there you go.
Thee are a variety of scams purportedly from Geek Squad
(please tell me you have never used them)
This is from July 2022 and should be immediately obvious for all the typical reasons:
Notice the red outlines:
The email address is from a hacked account at the Peru State College.
The subject is Order No: GK-41239439 Date: 26th JULY
The body is:
Geek-Squad-Scam
Notice there is no actual company logo or signature block.
This, BTW is the actual Geek Squad logo:
Geek-Squad
And the return email address is the hacked .edu account.
Also the generic salutation of Dear Customer should be your first clue.
And of course the total amount you have allegedly been charged is always an outrageous amount. in this case $399.99. A number guaranteed to make you say “WTF ?!?!?!?”
And the last line tells you a lot:
“Make sure your computer is on when you call.“
This tells you they will convince you to let them remote in and steal all the information necessary to make you a victim of Identity Theft.
Don’t fall for these scams. Block the email address, delete the message and move on.
The next version of the Geek Squad scam from September 2022:
This is very nicely crafted, but the return address makes it obvious this is a scam.
And from way back in 2021 comes this hideously poor attempt:
It looks like it was written in 1997 on an old Mac.
Watching Porn Scam
And then of course there is the “I’ve been watching you” scam.
This extortion scheme is designed to scare you into giving the sender a large sum of cryptocurrency to not disclose your dirty little secret of surfing porn while pleasuring yourself at the computer. The first question you have to ask yourself is very simply “Have I been doing this?” If the answer to this is a resounding “NO” – then you can just delete the email and go on with your life. Even if the answer is “yes… Dammit!” You’re probably still fine.
Second question: “Do I have a camera on this computer?” And if the answer is “No” then again, no problem. But if the answer is “yes… Dammit!” then you could actually be in trouble. But again… Probably not.
Here is what this scam looks like:
This was sent to a client last year:
Excerpt from the email:
“While gathering information about you, i have discovered that you are a big fan of adult websites. You love visiting porn websites and watching exciting videos while enduring an enormous amount of pleasure. Well, i have managed to record a number of your dirty scenes and montaged a few videos, which show how you masturbate and reach orgasms.
If you have doubts, I can make a few clicks of my mouse, and all your videos will be shared with your friends, colleagues, and relatives. Considering the specificity of the videos you like to watch (you perfectly know what I mean), it will cause a real catastrophe for you.
I also have no issue at all with making them available for public access (leaked and exposed all data). General Data Protection Regulation (GDPR): Under the rules of the law, you face a heavy fine or arrest. I guess you don’t want that to happen.
Let’s settle it this way:
You transfer 1.5 Bitcoin to me and once the transfer is received, I will delete all this dirty stuff right away. After that, we will forget about each other. I also promise to deactivate and delete all the harmful software from your devices. Trust me. I keep my word.“
As with all the other scams, block the sender email (which in this and most other cases is usually junk and does not actually exist) and have a nice day.
But be careful out there.
Original post and updates:
Recently it has been Norton renewal emails.
And some other random inbox overloading scams
Lately there has been a dramatic uptick in fake Norton renewal scam emails.
They come in a variety of designs, but most are embarrassingly mundane, devoid of logos or graphics and poorly crafted at best. Most share a common characteristic in that they appear to be a renewal notice. The other factor they share is that the renewal is for an exorbitant amount of money. I have seen them range from just under $200.00 to over $500.00. Another common factor is that you need to call a phone number to request a refund from them.
These are SCAMS.
You can quickly tell this is is not a legitimate email because:
You’re not using Norton (terrible product anyway)
Norton is not that expensive
The email would come from a legitimate Norton or LifeLock address.
You would be addressed by name.
The company logo would be obvious.
All company contact data would be obvious.
The email would be HTML (website look and feel) – not just badly formatted text.
Never call these phone numbers.
The people on the other end of the phone are very adept at separating you from your money.
Some recent examples below. I will add more as I discover them.
This one slipped through even Gmail’s superior spam protection:
When Johnny Depp emails you about your “Norton protection” you should pay attention, right?
This from September 9, 2021
October 1, 2021 addition:
This may be the most hideous attempt I have seen so far.
I didn’t even bother highlighting all the grammatical / punctuation errors, as it would take too long, but here is one from “Microsoft” charging a client for “Microsoft Defender” (there is no such thing).
September 30, 2021 update:
One of the red flags that should always alert you is the use of gmail addresses. Needless to say, no legitimate big name company is emailing through gmail.
One thing you CAN do to waste some time for these scammers is to forward the email to abuse@gmail.com – this will get their email account shut down.
Also, the lack of greeting you by your REAL NAME is another red flag.
They want you to call them.
DON’T!
August 10, 2021 update:
I received EIGHT of these fake Norton billing emails today. ALL from Gmail addresses that I promptly reported to abuse@gmail.com
Observe the minor differences in the gallery below:
Zeon RansomwareYour PC Support ScamNorton-Scam-7-26Norton-Scam-7-13Norton-Scam-6-29Norton-LifeLock-ScamNorton-Lifelock-Scam-7-15-21Norton-Lifelock-Scam-7-15-21-2Norton-Fake-7-8-21Norton-205Norton-200Norton-9-7-21-scanJohnny-Depp-NortonFake-Norton-Email-6-22Defender-Email-ScamAmazon-TP-Link-scam8-10-Norton-Scam-88-10-Norton-Scam-78-10-Norton-Scam-68-10-Norton-Scam-58-10-Norton-Scam-48-10-Norton-Scam-38-10-Norton-Scam-28-10-Norton-Scam-11-9-23-McAfee-Scamwindows-defender-fakeWindows 10 fake keyblock-suspiciousMicrosoft fake popup 1Fake-PayPal-Noticefake-BSOD
Leave a Reply
You must be logged in to post a comment.