Menu
Reply
r_beacroft
  • 2
  • 0
  • 2
Joining in
1,268 Views
Message 1 of 8
Flag for a moderator

Beware of fraud from [Removed]

At work an email was received from [Removed] to someone directly in accounts who tried to get the payroll bank details changed to their own. My guess by using LinkedIn to find the appropriate individuals and tried their luck with the email address construction.

I used to be a virgin media broadband customer and am hoping the broadband security wasn't breached to obtain my work details...

Below is an excerpt from the email received.

From: [Removed]
Sent: 17 October 2019 16:00
To: [redacted for security reasons]
Subject: Paula

Hi Paula,
I opened a new bank account recently and would like to change my bank details on payroll, is it going to be effective for October pay?
Kindly get back to me if you can sort this out for me.
Kind regards,
Richard

We played along to get their account details (which we will raise with the appropriate bank to have their account closed) and they then responded with:

Here are the new account details for you to amend:
Account Name: [Removed]
Sort Code: [Removed]
Account: [Removed]
When is this months salary going out? So i can activate my direct debits on the account
Thanks,
Richard

 

 [MOD EDIT: Personal and private information has been removed from this post. Please do not post personal or private information in your public posts. Please review the Forum Guidelines]

Nathan_B
  • 2.88K
  • 56
  • 145
Moderator
Moderator
1,237 Views
Message 2 of 8
Flag for a moderator

Re: Beware of fraud from [Removed]

Hi there, thanks for flagging this to us.

 

I have raised this to our team for investigation for you.

 

If you need anything further please let us know 🙂

 

Nathan B

The do's and don'ts. Keep the community welcoming for all. Follow the house rules


0 Kudos
Reply
jonc_uk
  • 7
  • 0
  • 1
Tuning in
1,195 Views
Message 3 of 8
Flag for a moderator

Re: Beware of fraud from [Removed]

Hi,

We also received one of these yesterday. It was spoofed from a company director to the HR Manager:

Hi  <HR PERSON>,

I opened a new bank account recently and would like to change my bank details on payroll, is it going to be effective for October pay?

Kindly get back to me if you can sort this out for me.

Kind regards,

<DIRECTOR>

Received at Thu, 17 Oct 2019 at 16:34. The director is not on Linked In so that was not the source of the info. Company is online retailer based in Stockport.

0 Kudos
Reply
Nathan_B
  • 2.88K
  • 56
  • 145
Moderator
Moderator
1,172 Views
Message 4 of 8
Flag for a moderator

Re: Beware of fraud from [Removed]

Ah ok, thanks.

 

Was this from the same email address?

 

Nathan B

The do's and don'ts. Keep the community welcoming for all. Follow the house rules


0 Kudos
Reply
jonc_uk
  • 7
  • 0
  • 1
Tuning in
1,165 Views
Message 5 of 8
Flag for a moderator

Re: Beware of fraud from [Removed]

Yes it was.

I googled the email address and Google had already cached the original post before you removed the email address.

We have inspected the headers of the email and are 100% sure it came from that account.

Nathan_B
  • 2.88K
  • 56
  • 145
Moderator
Moderator
1,155 Views
Message 6 of 8
Flag for a moderator

Re: Beware of fraud from [Removed]

Right ok, thanks for the confirmation.

 

Will update the team investigating this.

 

Nathan B

The do's and don'ts. Keep the community welcoming for all. Follow the house rules


0 Kudos
Reply
ravenstar68
  • 19.36K
  • 1.14K
  • 8.43K
Very Insightful Person
Very Insightful Person
1,133 Views
Message 7 of 8
Flag for a moderator

Re: Beware of fraud from [Removed]

I'm curious to see the authentication results from the headers?

Given that as I recall - the email address included the term homeworks  Something doesn't add up - assuming my recall is correct

Tim

I'm a Very Insightful Person, I'm here to share knowledge, I don't work for Virgin Media. Learn more

Have I helped? Click Mark as Helpful Answer or use Kudos to say thanks

alanswan
  • 1
  • 0
  • 0
Settling in
624 Views
Message 8 of 8
Flag for a moderator

Re: Beware of fraud from [Removed]

Hi

I'm seeing similar emails this week (13th October 2020) from a virgin media email address.  Looking at the header information it looks to have originated from a virgin media MX record, as per the below:

From: [Removed] 
Sent: 13 October 2020 15:12
To:  [redacted for security reasons]
Subject: HOLLY

Regards
Alan

 

Hi,

    I opened a new bank account recently and would like to change my bank details on payroll, is it going to be effective for October pay?

Kindly get back to me if you can sort this out for me please.

Kind regards,

Cheryl.

 

0 Kudos
Reply