I received an email which was apparently from Sun Trust Bank. It was welcoming me to their online services. I have not signed up for such services.
I looked at the following data and it appears legitimate:
- The direct links provided are not spoofed nor linking to a scam site
- The email headers check out, they pass the SPF checks, the "received" chain appears to come from domains owned by Sun Trust, etc. (I am a software engineer and feel comfortable evaluating these. I can provide a de-identified set of headers if that would help)
- My primary bank, Republic Bank, is a medium sized regional bank. I checked to see if Sun Trust had acquired my bank. I could not locate any such information
- Sun Trust apparently did join with a local bank, BB&T, which my wife or had accounts with in the past. I need to review if those accounts are still open or were ever tied to this particular email address.
- The email did not provide the usual bait to entice me to call a scammer controlled number nor to click specific links
- As recently as a week ago, my credit reports from my credit card companies do not show any new accounts.
I have received scam emails using Sun Trust as a lever in the past. Those past emails contain the usual claptrap of spoofed links and enticement to act immediately.
Should I treat this current notice as legitimate? If so what should I generally expect when I call the customer service number shown on the Sun Trust website (NOT the number given in the email)?
If this notice is not legitimate, what clues am I missing?
Will my FICO and Transunion scores from my credit card providers show a new bank account being opened? If so, would it be a hard or soft pull?
Update I just got an email about a claim for $6.81 to someone with the same name as me but who lives somewhere else. Does this suggest a mixed up email address rather than an identity theft risk?