Email from a legit NZ company is raising red flags, could I get a second opinion please (not a scam email query).

Forums › IT Pro and developers › Email from a legit NZ company is raising red flags, could I get a second opinion please (not a scam email query).

K8Toledo

1018 posts

Uber Geek
+1 received by user: 311

#303782 8-Mar-2023 23:43

I just noticed this email in a clients inbox, red flags are no named recipient, no unsubscribe link, amateur sig, etc etc.

The particular client is in her 90's with substantial assets invested with the company below. Her husband recently died and no family in NZ.n

Not so much the email I'm concerned about but the Wealth Management Company that sent it. Just a single review on Google.

Company Website (obfuscated link)

1 | 2

3689 posts

Uber Geek
+1 received by user: 2174

Subscriber

#3047766 8-Mar-2023 23:53

I don't see too much wrong with that.

The to is empty because they will have BCC'd, and the links being wrong is probably their marketing team/person being a marketing team/person.....you're talking about a small business here by the looks.

The link you've put is not the same company, this is the company in question - https://yhpj.co.nz/

K8Toledo

1018 posts

Uber Geek
+1 received by user: 311

#3047823 9-Mar-2023 05:10

lxsw20:

I don't see too much wrong with that.

The to is empty because they will have BCC'd, and the links being wrong is probably their marketing team/person being a marketing team/person.....you're talking about a small business here by the looks.

The link you've put is not the same company, this is the company in question - https://yhpj.co.nz/

Hi yeah different site but essentially same firm. In 2020 it was split into two parts - Wealth Management, and Accounting.

There are around 70 emails that go back to 2017 - but most not spam. The mailing list spam started at the end of last year.

My main concern lies with the growing number of unsolicited emails being sent to my client without an unsubscribe link - totally illegal of course.

Not the sort of activity an upstanding, professional accounting firm would engage in....?

At first glance these look just like typical scam/phishing emails. There are 5 or 6 similar to the example screenshots below.

I'm wondering how reputable this company is now after the restructure? What do you think?

SirHumphreyAppleby

2938 posts

Uber Geek
+1 received by user: 1860

#3047825 9-Mar-2023 06:41

K8Toledo:

My main concern lies with the growing number of unsolicited emails being sent to my client without an unsubscribe link - totally illegal of course.

An unsubscribe link is not required. Even though the DIA has in their FAQ that a link is acceptable, the law actually requires that "... the unsubscribe facility allows the recipient to respond to the sender using the same method of communication that was used to send the principal message". Technically, that makes all that "noreply" nonsense illegal.

https://www.legislation.govt.nz/act/public/2007/0007/latest/whole.html#DLM405207

BlakJak

1330 posts

Uber Geek
+1 received by user: 735

Trusted

#3047873 9-Mar-2023 07:34

Ensure you're entirely comfortable with the variants of consent as defined by DIA. If your customer is their customer, they're entitled to correspond with her as pertains to the service she is consuming.
But not to take the piss.

Further, if they make such clunky efforts I'd be losing confidence in them and voting with my feet.

But perhaps first explicitly asking them, as a customer, to limit correspondence to that necessary to maintain the existing relationship. Clearly email about employing people at minimum wage is entirely inappropriate?

No signature to see here, move along...

K8Toledo

1018 posts

Uber Geek
+1 received by user: 311

#3048101 9-Mar-2023 14:46

SirHumphreyAppleby:

K8Toledo:

My main concern lies with the growing number of unsolicited emails being sent to my client without an unsubscribe link - totally illegal of course.

An unsubscribe link is not required. Even though the DIA has in their FAQ that a link is acceptable, the law actually requires that "... the unsubscribe facility allows the recipient to respond to the sender using the same method of communication that was used to send the principal message". Technically, that makes all that "noreply" nonsense illegal.

https://www.legislation.govt.nz/act/public/2007/0007/latest/whole.html#DLM405207

I disagree, and the link you posted confirms what I said? It is illegal to send unsolicited emails without an unsubscribe link.

SirHumphreyAppleby

2938 posts

Uber Geek
+1 received by user: 1860

#3048102 9-Mar-2023 14:50

K8Toledo:

I disagree, and the link you posted confirms what I said? It is illegal to send unsolicited emails without an unsubscribe link.

Also, refer to Mark's comment above.

Apple TV

Stream your favourite shows now on Apple TV (affiliate link).

K8Toledo

1018 posts

Uber Geek
+1 received by user: 311

#3048103 9-Mar-2023 14:51

SirHumphreyAppleby:

K8Toledo:

I disagree, and the link you posted confirms what I said? It is illegal to send unsolicited emails without an unsubscribe link.

Also, refer to Mark's comment above.

Could you clarify?

K8Toledo

1018 posts

Uber Geek
+1 received by user: 311

#3048106 9-Mar-2023 15:04

BlakJak: Ensure you're entirely comfortable with the variants of consent as defined by DIA. If your customer is their customer, they're entitled to correspond with her as pertains to the service she is consuming.
But not to take the piss.

Further, if they make such clunky efforts I'd be losing confidence in them and voting with my feet.

But perhaps first explicitly asking them, as a customer, to limit correspondence to that necessary to maintain the existing relationship. Clearly email about employing people at minimum wage is entirely inappropriate?

For sure.

And the email screenshots I posted were just a couple of examples, there are others but I will not post .

To quell any doubts, I've had a long term (working) relationship with this client. And she is aware.

The replies here in this thread and also several by PM have been most helpful.

Thanks everyone. :)

SirHumphreyAppleby

2938 posts

Uber Geek
+1 received by user: 1860

#3048118 9-Mar-2023 15:10

K8Toledo:

Could you clarify?

The law requires that recipients be able to unsubscribe using the same method of communication, but there does seem to be some flexibility there, with the DIA stating an unsubscribe link is an acceptable means to comply (not a required means to comply). E-mail was the method of communication, so strictly speaking, a compliant unsubscribe method would require a valid reply-to e-mail address. A statement such as ‘If you do not wish to receive future messages, send a reply with UNSUBSCRIBE in the subject line’ is acceptable and fulfills the requirements.

See https://www.dia.govt.nz/Spam-Three-Steps

This page also deals with consent. The e-mail provides information regarding operational matters that are relevant to all clients (I.e. continuation of business) and provides additional information that may be relevant to some clients. Given the nature of the communication, I don't consider an unsubscribe link was necessary in this instance.

They should have used the word affected, not impacted, but you can't complain to the DIA about that one, no matter how much I wish you could.

richms

29098 posts

Uber Geek
+1 received by user: 10208

Trusted

Lifetime subscriber

#3048191 9-Mar-2023 16:47

SirHumphreyAppleby:

The law requires that recipients be able to unsubscribe using the same method of communication, but there does seem to be some flexibility there, with the DIA stating an unsubscribe link is an acceptable means to comply (not a required means to comply). E-mail was the method of communication, so strictly speaking, a compliant unsubscribe method would require a valid reply-to e-mail address. A statement such as ‘If you do not wish to receive future messages, send a reply with UNSUBSCRIBE in the subject line’ is acceptable and fulfills the requirements.

Except that braindead organizations expect you to reply from the address that they have emailed to, and many of them do not put that information in the body of the email about where it went to and expecting an end user to dig into headers to see what they delivered to is not a reasonable experience.

A working unsubscribe would have all the information in the body of the email for the sender to unsubscribe if they get a bounce or unsub reply, but it seems that many cheapskates in NZ try do to mail outs on their exchange server with the same body for everyone. I help those people learn the errors of their ways by reporting spam on the emails.

Richard rich.ms

Blurtie

487 posts

Ultimate Geek
+1 received by user: 131

#3048271 9-Mar-2023 19:33

K8Toledo:

SirHumphreyAppleby:

Also, refer to Mark's comment above.

Could you clarify?

IANAL - but if I was, then I would say it may come down to the interpretation of 'a functional unsubscribe facility' - it doesn't expressly state the form the unsubscribe facility needs to be in, only that there is one available and that it's functional.. Based on the screenshots provided, I would argue that they would fall foul of section (1)(b) - I can't see any mention or option of unsubscribing in a 'clear and conspicuous manner'... Which then begs the question whethere there is in fact a 'functional unsubscribe facility' is present at all?

HP

Shop now for HP laptops and other devices (affiliate link).

K8Toledo

1018 posts

Uber Geek
+1 received by user: 311

#3048880 11-Mar-2023 10:28

Hi, so closer inspection confirms there are phishing emails coming in after all. I also checked the headers of five suspect emails with MXToolbox and all were blacklisted.

I think it's possible the previously mentioned accounting firm's email server may be compromised. This has to with events IRL that I won't go into....:)

Inside the red squares below you'll see a company name.

Screenshot on the left is the original image (taken from mailchimp). Screenshot on the right is the shopped image from a phishing email.

Another one.

Is it likely the company email server above is compromised, as I'm wondering if I should contact them.

Jase2985

13730 posts

Uber Geek
+1 received by user: 6202

ID Verified

Lifetime subscriber

#3048881 11-Mar-2023 10:33

i dont see it?

BlakJak

1330 posts

Uber Geek
+1 received by user: 735

Trusted

#3048906 11-Mar-2023 12:38

If you suspect strongly enough, call them. Never hurts to verify.

Phishers who achieve a BEC will leverage it for all their worth... Including to compromise others.

No signature to see here, move along...

lxsw20

3689 posts

Uber Geek
+1 received by user: 2174

Subscriber

#3048909 11-Mar-2023 12:51

Jase2985:

i dont see it?

I see a dog with a bone, thats about it.

1 | 2