IS Security

Bank of America Phishing Email

03/10/07

06:30:29 am, by dave

, 485 words, 1536 views

Categories: Security, Phishing

Bank of America Phishing Email

Last night I received the following email, supposedly from Bank of America.

Bank of America phishing email image

It is NOT from Bank of America, it is a phishing email. If you get an email like this DELETE IT

[More:]

There are a couple of problems with the link contained in this message.

First, the link in the email it points to an internet address that does not match the text in the link. In this case, the link that you see has a web site name, for Bank of America, but when you hover over the link it points to an IP Address not an actual name, any time I see something like this I get concerned and usually check into the email further.

Second, the link you see has a site address of ...../sas/sitekey/profile/step1.htm the actual location you are taken to is ......./sitekey/sas/profile/step1.htm. So before following a link in an email, always validate that what you see is what you get.

Here is the actual email message.

Return-path: <service101@bankofamerica.com>
Envelope-to: [some address]@davemoats.com
Delivery-date: Sat, 10 Mar 2007 03:25:24 -0700
Received: from ns.ceip.spb.ru ([217.15.22.5] helo=172.20.1.6)
by [mail host] with smtp (Exim 4.63)
(envelope-from <service101@bankofamerica.com>)
id 1HPylO-0006xX-IJ
for [some address]@davemoats.com; Sat, 10 Mar 2007 03:25:23 -0700
Received: from 65.100.189.162 by ; Sat, 10 Mar 2007 16:15:17 +0600
Message-ID: <DOTKZLPKAMCVKWBNFXHJVTZ@yahoo.com>
From: "Bank of America Service" <service101@bankofamerica.com>
Reply-To: "Bank of America Service" <service101@bankofamerica.com>
To: [some address]@davemoats.com
Subject: Please Update Your Profile - Personal Information Error
Date: Sat, 10 Mar 2007 07:18:17 -0300
X-Mailer: Microsoft Outlook Express 5.00.2615.200
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="--81926197685736765"
X-Priority: 1
X-MSMail-Priority: High

----81926197685736765
Content-Type: text/html;
Content-Transfer-Encoding: quoted-printable

<html>
<img src=3D"http:// www. bankofamerica.com/images/mhd_reg_logo.gif">
<style>
text2 {
FONT-SIZE: 80%; COLOR: #333333; FONT-FAMILY: Verdana
}
</style>
 
Dear Bank of America Customer, 
 During our regularly scheduled account maintenance and verification procedures,
 we have detected a slight error in your account information.
 To securely confirm your personal information please click on the link bellow:
 
 <a href=3D"http:// 2XX.2XX.2XX.2XX /sitekey/sas/profile/step1.htm">http:// www. bankofamerica.com/sas/sitekey/profile/step1.htm</a>
 Confirm Your Bank of America Account and SiteKey now to enjoy the benefits of
 online banking and finance to avoid identity theft and fraudulent activities on
 your account.
 Note: We will be upgrading our yearly SSL EncryptedServer to prevent fraudulent
 activity.
 =A9 2007 Bank of America Corporation. All rights reserved.
</html>

----81926197685736765--