cancel
Showing results for 
Search instead for 
Did you mean: 

Overpayment Refund Scam Email Warning

JonoH
Community Gaffer
Community Gaffer
Posts: 4,328
Thanks: 7,447
Fixes: 153
Registered: ‎29-09-2011

Re: Overpayment Refund


@shutter wrote:

Just thought I would pass the message on to PN via the forum, and for the benefit of others, who may well have been "taken in" by it.

I really do appreciate it.

 Jono H
 Plusnet Community Manager
irritablegit
Rising Star
Posts: 94
Thanks: 8
Fixes: 1
Registered: ‎28-03-2009

Re: Overpayment Refund

That's ok.  Spam emails are annoying and frankly hard to avoid, but there are ways to cut them back.

 

For anyone who isn't aware, the email or domain (or both) of spammers can be entered in Plusnet's

White/Blacklist Filtering:

Paste it into the Blocked section, obviously ... and it should prevent their emails even appearing in your inbox in future

 

GDD1000
Dabbler
Posts: 13
Thanks: 5
Registered: ‎23-12-2016

Re: Overpayment Refund

It does look as if I have been pwned but it was in 2017 and I became aware of it so changed my passwords. 

pjmarsh
Superuser
Superuser
Posts: 3,659
Thanks: 1,329
Fixes: 14
Registered: ‎06-04-2007

Re: Overpayment Refund

@GDD1000, that is always good practice, though your email address will still be on the lists as at least a once active email address, so from time to time will still be targeted.

Superusers are not staff, but they do have a direct line of communication into the business in order to raise issues, concerns and feedback from the community.

merlin1
Dabbler
Posts: 17
Thanks: 5
Registered: ‎23-02-2011

Re: Overpayment Refund

This has reared its head again.  Two fake messages yesterday and two more today with a fake PN webpage inviting you to login to claimn the £185.21 overpayment

one comes from Plusnet [Support] [030CA9] <s.d.lewis at live.co.uk> with a link to a page on 

crm.newcitydhancapital.com the registrar for the domain is namecheap.com and the r tegistrant purports to be in Reykjavik

Be warned and don't click on any links

Moderator's note by Mike (Mav): Email and web addresses edited to make them unclickable.
Dancer2
Dabbler
Posts: 22
Thanks: 2
Registered: ‎26-11-2009

Re: Overpayment Refund Scam Email Warning

Sadly I responded to this dreadful scam...worried. What do I do now?

Tags (1)
jab1
Aspiring Legend
Posts: 12,725
Thanks: 4,041
Fixes: 162
Registered: ‎24-02-2012

Re: Overpayment Refund Scam Email Warning

@Dancer2 I don't know what details that 'Claim Refund' link asked for, but if it was your bank account details, immediately contact your banks fraud Team and explain the situation - they will help and advise you.

John
Alex
Community Veteran
Posts: 5,500
Thanks: 921
Fixes: 13
Registered: ‎05-04-2007

Re: Overpayment Refund

@merlin1

I would not click on links as suggested, but you have just posted a live scammer e-mail address and one of the live links we shouldn't have clicked on?
merlin1
Dabbler
Posts: 17
Thanks: 5
Registered: ‎23-02-2011

Re: Overpayment Refund

@Alex 

First the email supposedly came from PlusNet Support but this was a spoof from the email address quoted, the second email also claimed to be from PlusNet Support but the actual email address was different.  These email addresses will no doubt be throw away rather than belonging to a real person.  They were not links to a bad website.  I quoted one to illustrate that the PN support was spoofed.

Secondly I did note quote a live link to the payload but the domain (or more accurately subdomain) used to host the payload.  The full URL has rather more text after the domain name eg /***/****/*** etc.   If I had quoted that and you followed the link, yes you woul get to the payload, but I did not do that.

The implied question is why would PlusNet be using a domain registered to a site in Iceland rather than its own domain. Clearly it would not.

Thank you for raising this as it has prompted mne to give a fuller explanation.

 

GDD1000
Dabbler
Posts: 13
Thanks: 5
Registered: ‎23-12-2016

Re: Overpayment Refund Scam Email Warning

The best advice is to contact your bank.  You should also advise Action Fraud.  Be aware that the scammers may use what you've given them to contact you so be on your guard.

Dan_the_Van
Seasoned Champion
Posts: 1,357
Thanks: 456
Fixes: 38
Registered: ‎25-06-2007

Re: Overpayment Refund Scam Email Warning

@Dancer2 

Hopefully you have advised your bank by now.

But, a word of warning, as above, on the information you provided via the link scammers might contact you saying that they are your bank to say you account has been compromised, saying you need to transfer your money to a 'safe account'. A real bank would not instruct you to do this and you should hang up call the immediately. Regardless how much they may insist they are your bank, a real bank fraud line would accept you being cautious.

Do not call any number someone give's you over the phone, check your banks website and use the contact us number found there.

 

Townman
Superuser
Superuser
Posts: 20,946
Thanks: 8,442
Fixes: 113
Registered: ‎22-08-2007

Re: Overpayment Refund Scam Email Warning

... and do not be sucked in by a call with a CLI belonging to your bank.  Ask for a case reference and say you will call them back.  Then place the call yourself, using a known number, having ensured that you have a dial tone first (if using a land line).

Fraudsters have been known to spoof the CLI of banks / credit card fraud departments and (when you say you will call back) hold the line open whilst you "blind dial" (typically) on a phone where you dial (enter) the number and only then connect to line ... so you might not be aware that there was no dial tone ... and (unknown to you) you are still talking to the scammers.

Superusers are not staff, but they do have a direct line of communication into the business in order to raise issues, concerns and feedback from the community.

GDD1000
Dabbler
Posts: 13
Thanks: 5
Registered: ‎23-12-2016

Re: Overpayment Refund Scam Email Warning

This has all happened to me recently so please follow the advice you have been given.  It is absolutely likely to happen.