This topic

Phishing email received quotes part acc

RPendrigh — Sun, 12 Dec 2021 16:55:00 GMT

Hello. If this is not the correct place for the enquiry please feel free to move it.

I received a legit looking email stating my direct debit is no longer active. It contains actual BT links but BT confirmed on call it was not sent by them.

Also checked BT account and bank account online and DD still active.

Issue is that mail correctly quotes last 4 digits of my BT account, which is concerning. Assuming this is all any scammer has but still an issue

I have forwarded to phishing@bt com.

Has anyone else had this?

Re: Phishing email received quotes part acc

Keith_Beddoe — Sun, 12 Dec 2021 17:06:21 GMT

@RPendrigh

The spammer would have sent thousands of these emails, changing the last four digits each time, in the hope of catching someone out. There would only be a certain combination of those four digits.

Provided you did not click on any of the links, you should be fine.

Re: Phishing email received quotes part acc

gg30340 — Sun, 12 Dec 2021 17:18:42 GMT

See links

https://community.bt.com/t5/Announcements-Guides-Community/Scam-Alert-Phishing-email-pretending-to-come-from-BT-Billing/td-p/2121966

Scam Alert! Phishing email related to updating you... - BT Community

Scam Alert! Update your account info - BT Community

https://community.bt.com/t5/Announcements-Guides-Community/Scam-alert-Phishing-attempt-related-to-BT-billing/td-p/2055546

https://community.bt.com/t5/Announcements-Guides-Community/Scam-Alert-Update-your-account-info/td-p/2071276

Re: Phishing email received quotes part acc

RPendrigh — Sun, 12 Dec 2021 17:30:31 GMT

Hello

Thanks for the reply. Thinking about it you're probably right.

I had a similar attempt about 6 months ago but the account they quoted was completely wrong (they tried quoting the whole thing)

Still seems quite scary that the scammers randomly managed to get my email and part of the acc number right though.

Re: Phishing email received quotes part acc

Keith_Beddoe — Sun, 12 Dec 2021 17:39:07 GMT

@RPendrigh

They could have "farmed" your email from anywhere you may have posted it, or one of your contacts has had their email account compromised and their contact list stolen.

Its easy to create scripts to send out thousands of emails from a open SMTP server.

Re: Phishing email received quotes part acc

judex — Mon, 13 Dec 2021 11:21:55 GMT

Yes I've just had this too, today. How do spammers know my account number? I checked my DD and it's still working.

Jude

Re: Phishing email received quotes part acc

Keith_Beddoe — Mon, 13 Dec 2021 11:29:16 GMT

@judex wrote:

Yes I've just had this too, today. How do spammers know my account number? I checked my DD and it's still working.

Jude

They do not need to know, all they do is to send out thousands of emails with different four digit numbers, and they are bound to catch someone out. And they would divulge their bank details.

Phishing Attempt - contained valid account data

Adam_G — Thu, 16 Dec 2021 13:10:07 GMT

I have raised this issue with the BT Data Protection team at the start of the week, but thus far they have failed to respond.

Over the weekend I got a Phish asking me to update my direct debit details for BT, there were some obvious issues highlighting it was a phish, including mentioning the wrong ISP in the text. However the concerning thing is they included the last four digits of an account number, normally you'd notice these don't match but in this case they were the last four digits of a BT account I had until 2019 and it was sent to the e-mail address registered for that account.

Anyone else had this?

BT/BT Mods can you check this is being investigated? Unless it was sheer fluke they guessed the number then there are only two places those numbers could have come from BT or my e-mail provider.

Concerning that there is a potential data leak here and yet no response from BT in four days.

Screen shot below - numbers removed from image.

Re: Phishing Attempt - contained valid account data

gg30340 — Thu, 16 Dec 2021 13:15:48 GMT

Adam_G

I have moved you onto this thread to save having to repeat everything.

Re: Phishing Attempt - contained valid account data

Adam_G — Thu, 16 Dec 2021 14:10:42 GMT

Thanks @gg30340 I'd not noticed this one.

So there are others who have had the same thing on the same day by the looks of it.

Based on that I do not buy the phisher got lucky, so lets ignore getting a valid e-mail for a BT customer (mine is not a BT e-mail address) there is a 1 in 10,000 chance of getting one right, so getting multiple ones right in the same day is more than just chance/luck.

So can we disregard the luck/chance and BT look into the fact that it looks like someone has got hold of this data from either their systems or an e-mail platform?

Re: Phishing Attempt - contained valid account data

gg30340 — Thu, 16 Dec 2021 17:44:27 GMT

The type of email you have received has been circulating for years. It is not just BT customers who receive them nor is it only the BT ISP header that is used in the scam. Other ISPs also get named in the same type of email and or texts.

It has been put to BT in the past that their systems have been compromised and that it may be that some of their staff may be selling/using customers details for illegal purposes. This was denied.

I can not recall what the exact content of the denial was but it was along the lines of it being a coincidence.

Looking at the email you received if the scammer actually had your account details why wouldn't the scammer use your name in the email which would make it look more genuine and as in your email why would they tell you to use a Vodaphone app or call free from your Vodaphone mobile if they clearly know that you are a BT customer.

I also doubt that a human is actually sending out these emails, albeit that the program will have been set up and set to run by a human, they will be computer generated in their thousands if not millions and given that they only have to generate four random digits, they are bound to come up with the right numbers for some of the six million BT customers account at some point.

In any event, I am not hear to defend BT or any other ISP so I will look forward to hearing how you get on with your complaint.

Re: Phishing Attempt - contained valid account data

Adam_G — Thu, 16 Dec 2021 17:50:12 GMT

@gg30340 Perhaps I should have made it clear I work in the industry and I know a lot on this subject/area.

If you wish to believe that multiple people getting an email on the same day with the correct last four characters of the account number on is luck/random then I suggest you go and get a lottery ticket, the odds are similar.

The person or system sending these may only have some details but they clearly have some BT data. It seems the BT mods/BT wish to bury their heads in the sand too on this one. I have given BT 5 working days to respond that ends tomorrow so the ICO will be asked.

Re: Phishing Attempt - contained valid account data

gg30340 — Thu, 16 Dec 2021 18:03:29 GMT

I don't believe one way or the other. I was just putting forward some information however as you have made it clear that you know a lot about this and the odds of winning the lottery I will happily bow out of this thread.

Re: Phishing Attempt - contained valid account data

NeilO — Thu, 16 Dec 2021 18:54:07 GMT

@Adam_G & @RPendrigh I've just come across your thread this evening and can fully appreciate your concerns. I'd like to highlight this matter and will send you both a private message in a moment so you can send over your details.

Thanks

Neil

Re: Phishing Attempt - contained valid account data

RPendrigh — Thu, 16 Dec 2021 21:03:20 GMT

I have sent a reply to PM, hopefully this can be resolved quickly.

Re: Phishing Attempt - contained valid account data

Adam_G — Fri, 17 Dec 2021 08:54:26 GMT

Thanks @NeilO ,details sent in response to your private message.

Re: Phishing Attempt - contained valid account data

judex — Fri, 17 Dec 2021 13:48:55 GMT

I've been forwarding these emails to BT (I've received several similar over the last few weeks) but never had a response of course.

Re: Phishing Attempt - contained valid account data

Adam_G — Fri, 17 Dec 2021 13:52:08 GMT

@NeilO - can you send a private message to @judex As well so you have the details from the three of us who have seen this issue?