MatBennett.com

Received a nasty spoof mail today. Here’s the text:

Hello My name is Dave and I am from the Support of WorldPay. We have received the payment order (ID 0220712,Receipt Date 09/07/2006) from you and we need to make a verification of the details you have filled in, as we have received a notice from your card service stating that there was a chargeback made by the owner of the card with which you have made the payment and that your level of authorization has been altered during your last transaction. This is a very serious matter. We have deducted the amount of the chargeback, GBP 149.89, from your account and added our standard fee of GBP 24.00 as well (you can see your payment details in the attachment). We have failed to contact you using the telephone number you have provided earlier, meeting no response. As a precaution, we have limited access to your account in order to protect against future unauthorized transactions.Please understand that this is a security measure intended to help protect you and your personal information. Please contact your credit card company to resolve this matter. Best Regards, Dave Gollick shopper@uk.worldpay.com

Worldpay are a payment processor that I use at work to process card transactions and also use whilst shopping online myself, so I did initially take this as real.

The opening “my name is Dave” line did rouse my suspicions though, as it didn’t strike me as the way a company like Worldpay communicates. I also thought it strange that it came to an email address that I wouldn’t expect Worldpay to use and came through with nothing to identify me (name, merchant account, which phone number they tried to reach me on, last digits of card number etc), so took a closer look.

The email headers showed the mail originating from h163n5c1o269.bredband.skanova.com ([81.231.59.163]) which didn’t sound like Worldpay at all - so I gave them a call. The recorded message on their main enquiry number mentioned a “spam” email from Dave Gollick which confirmed what I suspected.

The email did also come with an attached zip file. This contained a numbered .exe file which my virus scan said was clean. Funnily enough though I don’t fancy running it to find out what it does!