CEO Scam/Phishing email

Forums › Off topic › CEO Scam/Phishing email

KellyP

1250 posts

Uber Geek
+1 received by user: 115

ID Verified

Subscriber

#209158 15-Mar-2017 11:11

This morning I received an email from someone pretending to be the officer of an incorporated society I belong to.

They are asking me to confirm that I'm able to send the funds ASAP and if so, they will send me the account details. My position in the society is Treasurer. The person supposedly sending the message is the Chair.

It appears to have been sent from an xtra address (personal email of chair) however the raw source shows a different address (reagan.com domain). The Reply-To field is also different (gmail address).

Is this an issue with Spark/Yahoo and their previous security breach or has the computer of the chair been compromised? I doubt it's the latter. Why spoof the email when you have control of the system?

Report to DIA?

MikeAqua

8024 posts

Uber Geek
+1 received by user: 3817

#1736724 15-Mar-2017 11:35

A number of people's xtra accounts seem to have been affected by this. I known of three.

Mike

Guv

94 posts

Master Geek
+1 received by user: 16

#1736726 15-Mar-2017 11:38

Not just xtra - its happening with others as well.

its a spear phishing scam.

freitasm

BDFL - Memuneh
80646 posts

Uber Geek
+1 received by user: 41030

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#1736730 15-Mar-2017 11:41

It happens a lot and it's usually targeted. The scammers find a company or society with some of the officer's name in the open, check a list of leaked email addresses and spoof a message from there.

Ignore.

Referral links: Quic Broadband (free setup code: R587125ERQ6VE) | Samsung | AliExpress | Wise | Sharesies

Support Geekzone by subscribing (browse ads-free), or making a one-off or recurring donation through PressPatron.

plas

456 posts

Ultimate Geek
+1 received by user: 59

#1736771 15-Mar-2017 11:54

All you can do is implement strict email filtering, educate users and establish solid business processes for validating funds transfers e.g face to face, 4eyes etc.