Mails that typically claim to be from Citibank, eBay, PayPal or other banks state that because of some problem the recipient needs to confirm his/her access codes or his/her account will be suspended. Other common tricks are fake payment disputes on eBay purchases, credit card or PayPal debit notices for goods not purchased questions from buyers of goods one is not selling. These surprising emails are supposed to trick people into acting rashly, without thinking.

Some of these emails look almost exactly like the real thing, complete with company logos, etc. Don't fall for it! Citibank, PayPal and other financial institutions never contact their customers supplying a link for re-entering their account numbers, passwords or PIN-codes. Though the links lead to websites that look like official company websites and in some cases even the browser displays a matching URL, these sites are in fact put up by fraudsters and are usually hosted on servers in China or on hacked computers. It is suspected that Russian organized crime groups are the main operators of this type of scam.

Closely related to the phishing scams are parcel remailing scams and "Money Agent" scams. The same gangs that run phishing scams to crack eBay / PayPal / online banking accounts then recruit job seekers using fraudulent job offers from fake companies. The employees are needed to receive and remail merchandise purchased using hacked eBay accounts and for forwarding money stolen from hacked accounts.

Both phishing and employment scams often involve botnets, networks of remote controlled computers running so-called "Trojan horse" software. The criminals controll tens of thousands of these "zombies" and use to send spam, to host fake websites and to attack other websites.

Example of 'phishing' scam:
On July 2 I received the following message:

From: "Support" <cash@citibank.com>
To: <joewein@pobox.com>
Sent: Friday, 02 July, 2004 0:01
Subject: Please confirm your account details with Citibank!


Dear Customer,


This email was sent by the Citibank server to verify your E-mail
address. You must complete this process by clicking on the link
below and entering in the small window your Citibank Debit
Card number and PIN that you use on ATM.


This is done for your protection - because some of our members
no longer have access to their email addresses and we must
verify it.


To verify your E-mail address and access your bank account,
click on the link below:

https://wwww.citibank.com/signin/confirmation.jsp


---------------------------------------

Thank you for being our customer

---------------------------------------

If you fill in totally bogus numbers and click submit, the site will accept them without complaint, as it does not verify them but only forwards them to the criminals...

'Phishing'-site hosted in China (China Telecom):
The actual scam website address (http://219.148.127.67/scripts/confirmation.htm) was still working two days after we received the spam email. The site is hosted by the following network:

     inetnum:      219.148.0.0 - 219.148.159.255
     netname:      CHINATELECOM-he
     descr:        CHINANET hebei province network
     descr:        China Telecom
     descr:        No.31,jingrong street
     descr:        Beijing 100032
     country:      CN
     admin-c:      CH93-AP
     tech-c:       BR3-AP
     mnt-by:       MAINT-CHINANET
     mnt-lower:    MAINT-CHINATELECOM-he
     changed:      hostmaster@ns.chinanet.cn.net 20030820
     status:       ALLOCATED NON-PORTABLE
     source:       APNIC
     
     person:       Chinanet Hostmaster
     address:      No.31 ,jingrong street,beijing
     address:      100032
     country:      CN
     phone:        10-66027112
     fax-no:       10-58501144
     e-mail:       hostmaster@ns.chinanet.cn.net
     e-mail:       anti-spam@ns.chinanet.cn.net
     nic-hdl:      CH93-AP
     mnt-by:       MAINT-CHINANET
     changed:      hostmaster@ns.chinanet.cn.net 20021016
     remarks:      hostmaster is not for spam complaint,please send spam 
                   complaint to anti-spam@ns.chinanet.cn.net
     source:       APNIC
     
     person:       Bin Ren
     nic-hdl:      BR3-AP
     e-mail:       renbin@mail.he.cn
     address:      10F Ximei Building NO.6 Jianshe South Street
     address:      Shijiazhuang 050011 China
     phone:        311-5211551
     fax-no:       311-5211578
     country:      CN
     changed:      renbin@mail.he.cn 20040430
     mnt-by:       MAINT-CHINATELECOM-HE
     source:       APNIC

When we checked on 2004-07-20, a total of 19 days after the initial email, the fraud website (http://219.148.127.67/scripts/confirmation.htm) was still active on the Chinanet server. It opens the real Citibank website, which shows a trustworthy-looking page with Citibank URL, but then pops up a window without URL line that runs a PHP script.

Are you sick of spam too? Do you want it stopped now? Try jwSpamSpy, the spamfilter we use to track the spammers! Free 30-day trial version available now!