Potential Phishing attempts

[DaveArthur1]

My wife has an old ntlworld account and, from the amount of obvious scamming attempts, the account is clearly compromised. She is now using another (Virgin account) but 2 of the most recent mails purporting to be from "The Virginmedia account team" and "Virgin Media Team" are borderline believeable.

The one purportedly coming from the account team is headed "ADMIN SECURITY UPDATE" with a "From" line showing  Virgin Media <tisoliver00@gmail.com>

The To line shows  - webteam@virginmedia  Blind copy (Wife's old ntl account)

The subject matter is Password reset code and the message is to click on a link to reset the password.                                                                                                                                                      

The second mail purports to come from Virgin Media <2728result @gmail.com> and the To line is the same as in the first (above). The message in this mail was that "We sent a code to J*****61 @virginmedia.com which was used to sign in to your VirginMedia account". 

None of the actions proposed in these mails has been taken but their content is such that I tried to speak to someone at Virgin to set my mind at rest. But that proved to be an impossible task and a "Chat Bot" for issues such as these is about as useful as a chocolate teapot. 

Can anyone confirm that my suspicions about these mailings are correct? If they are genuine however I really do need to speak to somone to guide me through what I need to do next.

Thanks

Dave Arthur

[goslow · Accepted solution]

The fact that the 'Virgin Media' display name in the messages masks Gmail email addresses shows that they are scam messages as you have suspected.

At the top of the 'Security matters' forum

https://community.virginmedia.com/t5/Security-matters/bd-p/Internet_Security

you will find regular updates on 'Latest phishing news' from which it is sometimes possible to match emails and text messages identified by VM as scams. Can't see the specific ones you have described in any recent updates there though.

[ALF28]

The sender address is not virgin, but gmail as goslow points out, and probably is fake, but designed to look like a virgin media message, it is probably phishing/hackers at work, I also get similar emails. They want you to click onto a link so they can get your data for hacking or fraud.

The virgin email contact address can be changed in the account profile, and any email address chosen, thus avoiding using an old email that is compromised or getting scam emails, and then any virgin emails to the old email address are obviously fake.

Probably wise to change the email account  password just to be sure.

These are sometimes picked up and tagged spam <spam>, but not always, by using a gmail address the scammer makes the email look genuine to get past the spam filters.

I now whitelist my inbox so any unusual emails are filtered to other folders, using the very good filter settings available, but the sender address often changes each time, so I was filtering all (contains) @gmail.com domain to a folder. I was getting so many fake emails from gmail.com that I have now (action) discard them as I have no genuine contacts using gmail.com, but this method will delete "all" gmails so is a bit drasic but as I no longer use the email, it blocks the scammers filling up my inbox.

Discarding emails need to be used wisely, but is good for blocking any repeat emails from a specific email address that you want to block and not receive any more.

Rather than click on links in fake virgin media "phishing emails", log onto the virgin media account only by going to the Official virgin media website and logging in to your account in the normal way to check the account is working and the password is working.

alf28

[ALF28]

blind copy

Forgot to mention- only recently, scammers are using Blind Copy followed by your own email address,

the "to" can be undisclosed recipients or some other email address which may be webteam@xxxx for example

This may be due to mass mailing from distribution lists and will be sent out in large numbers to a list using blind copy.

I have over 300 scam email from gmail.com, so a xxxx@gmail.com sender address is often used by scammers.

alf28

[DaveArthur1]

Thanks for confirming my suspicions.

Dave

[DaveArthur1]

Many thanks Alf28. Very helpful.

Dave