4

I received an email which was apparently from Sun Trust Bank. It was welcoming me to their online services. I have not signed up for such services.

I looked at the following data and it appears legitimate:

  • The direct links provided are not spoofed nor linking to a scam site
  • The email headers check out, they pass the SPF checks, the "received" chain appears to come from domains owned by Sun Trust, etc. (I am a software engineer and feel comfortable evaluating these. I can provide a de-identified set of headers if that would help)
  • My primary bank, Republic Bank, is a medium sized regional bank. I checked to see if Sun Trust had acquired my bank. I could not locate any such information
  • Sun Trust apparently did join with a local bank, BB&T, which my wife or had accounts with in the past. I need to review if those accounts are still open or were ever tied to this particular email address.
  • The email did not provide the usual bait to entice me to call a scammer controlled number nor to click specific links
  • As recently as a week ago, my credit reports from my credit card companies do not show any new accounts.

I have received scam emails using Sun Trust as a lever in the past. Those past emails contain the usual claptrap of spoofed links and enticement to act immediately.

Should I treat this current notice as legitimate? If so what should I generally expect when I call the customer service number shown on the Sun Trust website (NOT the number given in the email)?

If this notice is not legitimate, what clues am I missing?

Will my FICO and Transunion scores from my credit card providers show a new bank account being opened? If so, would it be a hard or soft pull?

Update I just got an email about a claim for $6.81 to someone with the same name as me but who lives somewhere else. Does this suggest a mixed up email address rather than an identity theft risk?

Improve this question
10
  • I did search and tried to find a CW article on this. As much as I watch the fraud and scam tags I feel like I should know how to handle this situation but I'm at a loss! I welcome any "close as dupe" flags if an answer exists.
    – Freiheit
    Jun 25, 2019 at 22:09
  • 12
    Have you called the bank (obviously from an independently sourced phone number) to verify whether or not an account was opened with your information?
    – quid
    Jun 25, 2019 at 22:21
  • 6
    Personally, I would be a whole lot more concerned with whether or not an account was fraudulently opened in my name than whether or not a possibly fake email would impact my credit score.... I would have called the bank before all of this, and you should call them now. Most banks can check for an account by your name and social.
    – quid
    Jun 25, 2019 at 23:18
  • 1
    Call the bank immediately at 1-BOB-BAERKER to find out where to send the check. OK, just kidding. Get the number of the bank from their web page. If that troubles you, get it from the White Pages. Contact Customer Service and ask to be connected to the Fraud & Security Department. Explain that you have received suspicious e-mail and that you may be the victim of fraud. Let them guide you from there.
    – Bob Baerker
    Jun 25, 2019 at 23:24
  • 1
    "direct links provided are not spoofed" Can we assume (given you're a software engineer) that you've checked the underlying source links (assuming an HTML format email) and have eliminated any Unicode-oddities that make a false address look like a real one? If so, call them and tell them that you didn't open an account... if it's not an error, someone may be trying to identity-theft you.
    – TripeHound
    Jun 26, 2019 at 8:43

2 Answers 2

Reset to default
16

You asked,

What do I do?

I think the answer is straightforward: Call Sun Trust and ask why you got the email. If the service rep who answers the phone doesn't seem to be able to give a satisfying answer, ask to be transferred to their fraud unit because you feel that you may be suffering from identity theft.

Scams can come in many forms. It seems that you're able to validate the email is not fake, which is a good step. However, it could easily be someone impersonating you and trying to open an account in your name. Even if they perform no activities that directly impact your finances, this can be an issue if they're using that account for money laundering or scamming other people, since law enforcement will come looking for you when those activities are uncovered.

There could be legitimate, or semi-legitimate reasons for the email - maybe Sun acquired a bank you'd used in the distant past and somehow incorrectly sent batch emails to "all customers" including you. Or any of a number of reasons. But calling them and asking should lead to an explanation, if that's the case.

Improve this answer
2
  • 1
    You must have been posting right as I dialed. I just called Sun Trust by looking up their number on their website. The clerk asked for my social and used that to look up any accounts and did not find any. I think at this point I have to assume that either it was a bad email address (someone entered @gmail instead of @aol) or basically a marketing email from some past contact with a bank that is now owned by Sun Trust.
    – Freiheit
    Jun 26, 2019 at 13:08
  • 5
    Email addresses are a really low quality identifier, they're mistyped all the time. Ultimately, if your SSN is clear, that's the thing that matters the most, since that's what's linked to your credit reports or any other identification method that matters. Personally, I'd still want to know exactly why they sent the email for curiosity's sake, but you may not get that answer from them.
    – dwizum
    Jun 26, 2019 at 13:12
3

What to do.

  1. Google the bank and go to their main website.

  2. Find their fraud number. If you can't find that, find their main number and work your way through the phone tree or getting transferred.

  3. Tell them about the email and ask why you are recieving it. Give them any identifying details the email would include such as last 4 digits of the account or the name on the account.

  4. If they can find the account, ask them to verify that none of your other personal information is being used on the account. They can't tell you what is on the account, as you could use this to social engineer your way into the account, but you can give them your phone number, address etc, to make sure the account isn't using that.

  5. If they they are unhelpful, make it clear you are a serious person, and you are keeping a paper trail and records of each conversation. Don't be mean, just be serious.

  6. Continue to monitor your credit accounts for new account openings.

Good luck!

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .