AMEX spam

[Flashback]

Is it worth forwarding things like this onto AMEX?

Disclaimer: don't click on the link, it's a fake!

Reference Number: 20082285452334
Dear American Express Card holder:
As part of the new security measures, all American Express Card holders are required to complete American Express Customer Form. Please complete the form as soon as possible.
To access the form please click on the following link:
[URL="http://removed_to_protect_members]http://www.americanexpress.com/myca/form/serverstack/action?request_type=107144223038432275412563611322[/URL]
Thank you for using your American Express Card.

Sincerely,
American Express Customer Service
Please do not reply to this e-mail. This Customer service e-mail was sent to you by American Express. You may receive customer service e-mails even if you have unsubscribed from marketing e-mails from American Express.
© 2008 American Express Company. All rights reserved.

 

[simongr]

I would forward it to Amex. I would also edit the link in your post in case someone is stupid enough to click on it.

 

[JohnK]

Did the link have specific Amex information related to you? I was going to ask where they get this information but I think I get the picture....

 

[Flashback]

Not sure John, I never clicked on it...

 

[NM]

Did the link have specific Amex information related to you? I was going to ask where they get this information but I think I get the picture....

The link was not to an Amex site, but to a phishing site that looked something like:

http://www.americanexpress.com.phishingsite.org/blahh/blahh/blahh etc.

 

[docjames]

I'd definitely report it to amex.

 

[serfty]

The URL in the OP was edited by NM to link to: http://"http//removed_to_protect_members

 

[Mal]

I also received a copy on one of my email accounts.

Didn't bother reporting it to Amex as the site had already been taken down (ie disabled) by the time I saw the email.

Never a wise idea to investigate suspicious emails (ie go to the links) unless you know what you're doing. I work in an area of IT that deals with that kind of stuff all the time so know what I'm doing...

 

[JohnK]

For those of us who are naive what could possibly happen by clicking on a bogus link out of curiosity but not provide further information?

 

[Mal]

For those of us who are naive what could possibly happen by clicking on a bogus link out of curiosity but not provide further information?

The worst that could happen is that malicious code on the website can download and run programs on your computer (normally due to a vulnerability in your Internet Browser). Other possibilities are being exposed to images that you do not wish to see (or are illegal), or having the website attempt to change your homepage to something else / pop up numerous adverts.

Occasionally URLs are personalised so that the spammer knows you clicked on it - ie knows to send you lots more similar spam.

Most common example for a spam like that is that you are presented with a page that looks relatively legit and enter in personal information that could lead to identity theft or dodgy charges to your credit card, or nothing if you don't provide any information.

 

[comint]

For those of us who are naive what could possibly happen by clicking on a bogus link out of curiosity but not provide further information?

The link may contain unique identifying information. So, when you click, the spammer may register that your email address is valid, that you clicked on their "american express" campaign, plus from your IP address they may also learn your general geographic location & who your ISP is. (Or do it from work, and they may learn who you work for.)

This can lead to a more tailored secondary emailing, which may seem even more legitimate. (Not necessarily using Amex again.) Designed to gain more personal information from you, perhaps a competition where you supply a phone number and postal address. And so on...

 

[NM]

For those of us who are naive what could possibly happen by clicking on a bogus link out of curiosity but not provide further information?

One scenario is that you are presented with an on-line form to complete that asks for things like your Amex card number, expiry date, security code, home address, date of birth etc, hoping some fool will provide all they need to complete the scam.

 

[JohnK]

One scenario is that you are presented with an on-line form to complete that asks for things like your Amex card number, expiry date, security code, home address, date of birth etc, hoping some fool will provide all they need to complete the scam.

I guess some people could be that naive.

I would not provide that type of information when clicking on any link so it is not really a worry. More of a concern is the type of damage they could do to a computer but if having decent firewall in place it may be OK. Best to leave alone links that have unknown origins....

 

[oz_mark]

One scenario is that you are presented with an on-line form to complete that asks for things like your Amex card number, expiry date, security code, home address, date of birth etc, hoping some fool will provide all they need to complete the scam.

Amex have some strange security policies. If they have to ring you, they say they need to ask some security questions to make sure they are speaking to the right person. Question is, how do you know it is actually Amex that is calling you

 

[NM]

I guess some people could be that naive.

I would not provide that type of information when clicking on any link so it is not really a worry. More of a concern is the type of damage they could do to a computer but if having decent firewall in place it may be OK. Best to leave alone links that have unknown origins....

Unfortunately some people are that naive. Even a very low rate of nativity can result in a lot of people being scammed. Its sad, but true.

Even if they present what looks like and Amex login page, some people will enter their username and password.

 

[JohnK]

Amex have some strange security policies. If they have to ring you, they say they need to ask some security questions to make sure they are speaking to the right person. Question is, how do you know it is actually Amex that is calling you

In these type of situations I have refused to provide the person any information and asked for contact details from them and then called the support number to verify that it is indeed a genuine caller....

 

[NM]

Amex have some strange security policies. If they have to ring you, they say they need to ask some security questions to make sure they are speaking to the right person. Question is, how do you know it is actually Amex that is calling you

Telstra are really good at doing that. They will call out of the blue to discuss your current plan. Like JohnK, I will not give any personal info to an unsolicited caller. I usually tell them that if I want to make a change I will contact them. And if they believe they have a better deal for me, then they can send me the details in the post and I will consider the options in my own time and without their instant response pressure.

 

[ejb]

Amex have some strange security policies. If they have to ring you, they say they need to ask some security questions to make sure they are speaking to the right person. Question is, how do you know it is actually Amex that is calling you

One way I have found to verify if they are real is to give the wrong information, say DOB (I give the wrong year) and if they pick up on it I know they are real.

Not foolproof but 1 small way of verifying who is calling.

ejb