Author Topic: Very convincing "Skrill" phishing scam (Read 11759 times)

lisafx · « **on:** February 27, 2014, 13:33 »

I received a pretty convincing Skrill phishing scam in my e-mail today. It was from "customerservice-at-skrill.com". Like most scam e-mails, it warned of account closuree, and said that I had to login through their link to agree to their new terms of service and privacy policy.

Unlike most of the scams I get, this one was not to "dear user", but addressed me by my skrill login. There were no misspellings or poor grammar, and the date of the "account closure" was not already expired (March 4).

I don't EVER click links in any e-mail with any type of warning, but it was convincing enough that I opened a browser and went to skrill's site to see if there was any popup warning there. Of course there wasn't. I called their customer service and, predictably, they said it wasn't sent by them and asked for me to forward to their help department.

Just thought I would post in case someone else got the same e-mail and was wondering if it is legit.

Ron · « **Reply #1 on:** February 27, 2014, 13:38 »

When you hoover over the URL in the email you will see the real location, often just a bit different then the real URL. i.e. Skril with 1 L This is then a mirror site, exact copy, and so they get your details.

lisafx · « **Reply #2 on:** February 27, 2014, 13:39 »

Quote from: Ron on February 27, 2014, 13:38

When you hoover over the URL in the email you will see the real location, often just a bit different then the real URL. i.e. Skril with 1 L This is then a mirror site, exact copy, and so they get your details.

Good tip, thanks!

Goofy · « **Reply #3 on:** February 27, 2014, 13:55 »

Thanks Ron!

Rinderart · « **Reply #4 on:** February 27, 2014, 14:07 »

excellent advice.

JPSDK · « **Reply #5 on:** February 27, 2014, 14:16 »

Life on the net is not so easy, you have to be constantly alert of those scammers, and there are many.
lets us say 3-5 every day in my inbbox and they are getting better every time. But so am I.

dirkr · « **Reply #6 on:** February 27, 2014, 18:12 »

Quote from: lisafx on February 27, 2014, 13:33

I don't EVER click links in any e-mail with any type of warning,...

That is the most important advice.

madelaide · « **Reply #7 on:** February 27, 2014, 21:37 »

I also got this and clicked on the link, because at first I didn't notice it showed "skrillv" instead of "skrill". Then I noticed also it was not protected (no lock icon) and, just in case, I tried a wrong password - it did not complain.

lisafx · « **Reply #8 on:** February 27, 2014, 23:20 »

Quote from: madelaide on February 27, 2014, 21:37

I also got this and clicked on the link, because at first I didn't notice it showed "skrillv" instead of "skrill". Then I noticed also it was not protected (no lock icon) and, just in case, I tried a wrong password - it did not complain.

Interesting. Glad you didn't give your real password.

I'm also relieved not to be the only one nearly taken in by this. It was very convincing, wasn't it?

Kamran · « **Reply #9 on:** February 28, 2014, 02:54 »

I have view source of email and found that sender has hidden/spoof his address and it showing [email protected]. The fake spammer address is http://account.skrillv.com/ which currently showing road sign image of CLOSED FOR MAINTENANCE. This server is hosted in Turkey. Hovering mouse on login button in Firefox shows unsecure http://account.skrillv.com/.... address. I entered dummy user name and password nothing happen.

lisafx · « **Reply #10 on:** February 28, 2014, 10:55 »

Quote from: Kaka2014 on February 28, 2014, 02:54

I have view source of email and found that sender has hidden/spoof his address and it showing [email protected]. The fake spammer address is http://account.skrillv.com/ which currently showing road sign image of CLOSED FOR MAINTENANCE. This server is hosted in Turkey. Hovering mouse on login button in Firefox shows unsecure http://account.skrillv.com/.... address. I entered dummy user name and password nothing happen.

Good information. Thanks for posting :-)

madelaide · « **Reply #11 on:** March 01, 2014, 20:52 »

Very convincing indeed, and I wonder if there is something behind it. I only got it on the email address that I use for Skrill. Ok, I do get a lot of spam and phishing scam there, but also in my Yahoo address, in which apparently this did not come too. I mean, did the sender have a list of Skrill customers?

The other day I got a phishing scam from a company, that kind of message confirming an online purchase. The fact that I had never purchased anything from them rang a bell, but the subject had my name and my register number. So it was not just a random email, someone had my data. Scary.

One has to be very careful these days.

lisafx · « **Reply #12 on:** March 02, 2014, 00:01 »

Quote from: madelaide on March 01, 2014, 20:52

Very convincing indeed, and I wonder if there is something behind it. I only got it on the email address that I use for Skrill. Ok, I do get a lot of spam and phishing scam there, but also in my Yahoo address, in which apparently this did not come too. I mean, did the sender have a list of Skrill customers?

The other day I got a phishing scam from a company, that kind of message confirming an online purchase. The fact that I had never purchased anything from them rang a bell, but the subject had my name and my register number. So it was not just a random email, someone had my data. Scary.

One has to be very careful these days.

Now that you mention it, I only got it on my skrill login e-mail address too. Seems a bit more targeted than random. We'll never know, I guess, but you're right, we have to be extra careful.