I received an email which was apparently from Sun Trust Bank. It was welcoming me to their online services. I have not signed up for such services.

I looked at the following data and it appears legitimate:

  • The direct links provided are not spoofed nor linking to a scam site
  • The email headers check out, they pass the SPF checks, the "received" chain appears to come from domains owned by Sun Trust, etc. (I am a software engineer and feel comfortable evaluating these. I can provide a de-identified set of headers if that would help)
  • My primary bank, Republic Bank, is a medium sized regional bank. I checked to see if Sun Trust had acquired my bank. I could not locate any such information
  • Sun Trust apparently did join with a local bank, BB&T, which my wife or had accounts with in the past. I need to review if those accounts are still open or were ever tied to this particular email address.
  • The email did not provide the usual bait to entice me to call a scammer controlled number nor to click specific links
  • As recently as a week ago, my credit reports from my credit card companies do not show any new accounts.

I have received scam emails using Sun Trust as a lever in the past. Those past emails contain the usual claptrap of spoofed links and enticement to act immediately.

Should I treat this current notice as legitimate? If so what should I generally expect when I call the customer service number shown on the Sun Trust website (NOT the number given in the email)?

If this notice is not legitimate, what clues am I missing?

Will my FICO and Transunion scores from my credit card providers show a new bank account being opened? If so, would it be a hard or soft pull?

Update I just got an email about a claim for $6.81 to someone with the same name as me but who lives somewhere else. Does this suggest a mixed up email address rather than an identity theft risk?

  • I did search and tried to find a CW article on this. As much as I watch the fraud and scam tags I feel like I should know how to handle this situation but I'm at a loss! I welcome any "close as dupe" flags if an answer exists.
    – Freiheit
    Jun 25 '19 at 22:09
  • 9
    Have you called the bank (obviously from an independently sourced phone number) to verify whether or not an account was opened with your information?
    – quid
    Jun 25 '19 at 22:21
  • 5
    Personally, I would be a whole lot more concerned with whether or not an account was fraudulently opened in my name than whether or not a possibly fake email would impact my credit score.... I would have called the bank before all of this, and you should call them now. Most banks can check for an account by your name and social.
    – quid
    Jun 25 '19 at 23:18
  • 1
    Call the bank immediately at 1-BOB-BAERKER to find out where to send the check. OK, just kidding. Get the number of the bank from their web page. If that troubles you, get it from the White Pages. Contact Customer Service and ask to be connected to the Fraud & Security Department. Explain that you have received suspicious e-mail and that you may be the victim of fraud. Let them guide you from there. Jun 25 '19 at 23:24
  • 1
    "direct links provided are not spoofed" Can we assume (given you're a software engineer) that you've checked the underlying source links (assuming an HTML format email) and have eliminated any Unicode-oddities that make a false address look like a real one? If so, call them and tell them that you didn't open an account... if it's not an error, someone may be trying to identity-theft you.
    – TripeHound
    Jun 26 '19 at 8:43

You asked,

What do I do?

I think the answer is straightforward: Call Sun Trust and ask why you got the email. If the service rep who answers the phone doesn't seem to be able to give a satisfying answer, ask to be transferred to their fraud unit because you feel that you may be suffering from identity theft.

Scams can come in many forms. It seems that you're able to validate the email is not fake, which is a good step. However, it could easily be someone impersonating you and trying to open an account in your name. Even if they perform no activities that directly impact your finances, this can be an issue if they're using that account for money laundering or scamming other people, since law enforcement will come looking for you when those activities are uncovered.

There could be legitimate, or semi-legitimate reasons for the email - maybe Sun acquired a bank you'd used in the distant past and somehow incorrectly sent batch emails to "all customers" including you. Or any of a number of reasons. But calling them and asking should lead to an explanation, if that's the case.

  • 1
    You must have been posting right as I dialed. I just called Sun Trust by looking up their number on their website. The clerk asked for my social and used that to look up any accounts and did not find any. I think at this point I have to assume that either it was a bad email address (someone entered @gmail instead of @aol) or basically a marketing email from some past contact with a bank that is now owned by Sun Trust.
    – Freiheit
    Jun 26 '19 at 13:08
  • 3
    Email addresses are a really low quality identifier, they're mistyped all the time. Ultimately, if your SSN is clear, that's the thing that matters the most, since that's what's linked to your credit reports or any other identification method that matters. Personally, I'd still want to know exactly why they sent the email for curiosity's sake, but you may not get that answer from them.
    – dwizum
    Jun 26 '19 at 13:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.