The Case of the Visa Scam

[danaeris]

Was it the bad grammar that gave them away? Or the email address? Or was it that feeling, that finely honed instinct of a private dick that told me something was fishy? All I know is that this email left me with that bad feeling you get in the pit of your stomach when faced with a particularly disappointing piece of vaporware.

From: Visa Service <security@visa-security.com>

Dear Sir/Madam,

We were informed that your credit card is used by another person or stolen. It could happen if you have been shopping on-line, and someone got your "Billing information" including your credit card number. To avoid and prevent any further fraud and billing mistakes and to refund your credit card, it is strongly recommended to proceed filling in the secure form on our site and applying for our Zero Liability program. Program is free and it will help us to confirm the fact of fraud and investigate this accident as soon as possible.

[button to continue]

Sincerely yours, Visa Support Assistant, Alwin Desagun.

Comments

[ghudson.livejournal.com]

Well, pretty much, if it's email directed at getting you to follow some URL and enter in personal or financial information, it's a scam. Bad grammar is a common feature of such scams, but it's hardly a universal one.

There are scams out there which do a pretty good job of looking like Amazon order status notifications or other official email that you're used to getting. To be safe, consider any link from an email message to be tainted as far as entering personal information, unless you've viewed the source of the message and carefully inspected the URL. An '@' sign followed by an IP address (or possibly just a big number) is a giveaway that the URL is fake; the part before the '@' sign is treated by the browser as a username, not as a hostname. If in doubt, go by hand to the front page of the relevant company (www.amazon.com, etc.) and log in from there.

Note that IE has a bug--still unpatched, I believe--which allows an attacker to make the location bar show a different URL than the one you're actually displaying. Scams are actively exploiting this bug. So, just because you clicked on a link and it says www.visa.com in the location bar doesn't mean you're there.

[lawbard.livejournal.com]

Yeah thats really atrocious...I had to go back and read it again to realize that for half of it I inserted the correct grammar on my own without realizing it.

Speaking of fraud and stolen card - how's the post-Arisia fallout going?