BBC Radio 4’s team investigate a new phishing scam which entices users to click on malware by claiming they owe money to UK firms.
Source: Phishing email that knows your address – BBC News
A new type of phishing email that includes the recipient’s home address has been received by thousands of people, the BBC has learned.
Members of the BBC Radio 4’s You and Yours team were among those who received the scam emails, claiming they owed hundreds of pounds to UK firms.
The firms involved have been inundated with phone calls from worried members of the public.
One security expert warned clicking on the link would install malware.
You and Yours reporter Shari Vahl was one of the first on the team to receive an email.
“The email has good spelling and grammar and my exact home address…when I say exact I mean, not the way my address is written by those autofill sections on web pages, but the way I write my address.
“My tummy did a bit of a somersault when I read that, because I wondered who on earth I could owe £800 to and what was about to land on my doormat.”
She quickly realised it was a scam and did not click on the link.
“Then, a couple of minutes later, You and Yours producer Jon Douglas piped up as he’d received one and then another colleague said he’d received one too, but to his home email address,” she added.
Ransomware
The You and Yours team decided to contact the companies that were listed in the emails as being owed money.
A spokesman for British Millerain Co Ltd, a waxed cotton fabric manufacturer, told the programme that the firm “had more than 150 calls from people who don’t owe us money”.
And a spokeswoman for Manchester shelving firm Greenoaks said: “My colleague took a call from an elderly gentleman and he was very distressed because his wife had had one of these emails.”
Dr Steven Murdoch, principal research fellow at the department of computer science at University College London, told You and Yours: “Most likely it was a retailer or other internet site that had been hacked into and the database stolen, it then could have been sold or passed through several different people and then eventually it got to the person who sent out these emails.”
He said that the email bore the hallmark of previous phishing attempts from gangs in Eastern Europe and Russia.
He said that clicking on the link would install malware such as Cryptolocker, which is a form of ransomware that will encrypt files on Windows-based computers and then demand a fee to unlock them.