(Public service announcement)
I received an email titled "URGENT: Your Master Card SecureCode Password has expired!" The email body is an image. Is it legitimate?
5 Answers
It's a fake! Don't fall for it or you'll regret it!
This is another classic example of what is called a phishing attack. This other question has another example.
The email in question was not from MasterCard, your bank, or your credit card company.
A phishing attack is a form of social engineering or pretexting where you are led to believe through an official-looking email that the notice is from a legitimate source when, in fact, it is not.
Cyber-criminals and online organized crime try to use phishing attacks to trick you into revealing your credit card number, your bank account information, your Social Security Number (SSN, United States) or Social Insurance Number (SIN, Canada) or any other kind of personal information.
Your bank, credit card company, or other financial account provider should never ask you in an email to visit their site through a link provided in the email.
Never trust a hyperlink provided in an email — odds are good it leads to a fake site created by criminals!
When in doubt about such a message, don't click anything.
Contact your financial service provider by phone to inquire, using the phone number on your card or on a previous bill.
Don't call any phone numbers in the message.
-
3don't even trust the link if it looks good, with the sans serif font most browsers use, you can use tricks like two v's instead of a w upper case i for lower case L to create a URL that looks good to the eye, but is sending you to a fake site e.g. FIovverbank.com and it will look just like Flowerbank on the url line Commented Jun 18, 2011 at 7:28
Most, if not all, banks, have an address that you should forward such messages to. Again, do not click on anything in the email itself, but go to your bank's website by opening a browser and typing in the address, then look for a link saying something about "fraud" or "phishing" attacks. It will probably have an email address, and then you should forward the phish email to that address.
In my experience - security issues are typically handled by banks via regular mail or a telephone call. Email is used for notifications like a new statement is available, or we did that transfer you asked us to.
Don't reply to the email or click the links on a security question.
CALL YOUR BANK instead. That is why the support phone number is on the back of the card.
Do not trust the hyperlink. If you feel there is even the slightest possibility that this is real, call the number on the back of your actual credit card. Don't click or call anything provided in the email.
I have similar experience, in cases like this banks are normally send you a normal mail and ask you to call them back. They never send you an email and ask you to do anything regarding to your password.