-1

I received an email similar to the one described here, thanking me for a recent premium payment to Humana. Of course, I don't have insurance with Humana.

Is this likely to be a scam? If so, how does this scam work? What will they gain from this?

I thought it might be phishing. The links in the email all go through links.mkt3525.com (the same redirector mentioned in the linked web page), but they seem to redirect to the real www.humana.com site. Redirections like this in emails are not that suspicious -- our company uses a couple of mass email services (SendGrid, Mailify) and they rewrite links in emails so they can provide reports on how many recipients click on your links (this is mostly useful for marketing emails).

The most suspicious thing was that the email was sent to my gmail address, which I rarely give out (I generally only use it when I create accounts at sites that want to link to a Google account). It also doesn't have any information identifying my account -- it doesn't address me by name, or show the last N digits of an account number.

I get the same emails every month, just like I would expect if I were a real subscriber.

Improve this question
  • Nothing in your question describes a scam? If you clicked the link the phisher now knows that to be a real/active email address. It makes good sense to direct all of the non-payment links to a real site, as long as the payment link goes to one controlled by the phisher. – quid Apr 3 '19 at 20:29
  • 1
    So it's just a scheme to collect emails of people who are stupid enough to click on links in email? – Barmar Apr 3 '19 at 20:36
  • Deleted a previous answer because I missed the subtlety about the links in the question. The linked message doesn't actually look like a scam to me if all the links are intact. It's certainly got a lot of elements that would make you not want to trust it (the lack of custom salutation, and the links to redirectors) but it could in fact be legit. – Todd Apr 3 '19 at 20:45
  • It could be that the phone number(s) in the email goes to a fake call center. It's hard to guess what the scam was when your question consists of only the reasons you think it wasn't a scam. – quid Apr 3 '19 at 21:27
  • 1
    @Steve-O When you tell a web site to link their account to your Google or Facebook account, I think it uses OAuth2 to connect the authentications, you don't actually give your Gmail address to the new site. There's some kind of opaque token involved. – Barmar May 3 '20 at 14:47
4

It may be that they are not after money from you. Instead, the links could redirect to a web site which will try to drop malicious software on your computer, after scanning your browser - and its plug-ins - for known vulnerabilities. if they are clever, they could then redirect you to the real Humana web site.

Improve this answer
  • Interesting idea, but I just tried with DevTools open and it didn't try to execute anything before redirecting. But maybe it checked my user agent and saw that I'm not on a vulnerable computer. But I doubt most malware does that -- it's easier to just try to drop what they want and catch the error than check first. – Barmar Apr 3 '19 at 22:53
0

This could be simply information gathering for future targeted attacks:

  1. Purchase, steal, or find a large cache of email addresses.
  2. Send an email to them all such that if clicked, you know which addresses have a person associated with them, redirecting to a real site immediately after recording the click to lesson the chance of suspicion.
  3. ???
  4. Profit.

Note: this only works if the links in each email are unique. It isn't clear from the question if that's the case, but typically it is.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.