Emails being intercepted and altered for fraud.
Discussion
We got a reminder at work that a bill was a couple of days overdue. It was correct, it was. The email ended - please let me know and I'll send you our new bank account details for payment.
The email was an altered version of an actual email sent by this company a few hours earlier - the altered part was obviously the bit about the bank details changing. The real email had been directed to the Hotmail Archive folder so we never saw it. The fake one appeared in the Inbox.
Now, I know that our emails were hacked a while back which is how they've obviously changed the settings to direct the emails from this company to the Archive folder.
How (and where) are they intercepting them in the first place though? Or do they still have access to our emails and are copying what's in the Archive folder?
The email was an altered version of an actual email sent by this company a few hours earlier - the altered part was obviously the bit about the bank details changing. The real email had been directed to the Hotmail Archive folder so we never saw it. The fake one appeared in the Inbox.
Now, I know that our emails were hacked a while back which is how they've obviously changed the settings to direct the emails from this company to the Archive folder.
How (and where) are they intercepting them in the first place though? Or do they still have access to our emails and are copying what's in the Archive folder?
Sounds like either the supplier's email is compromised or it's a 'man in the middle' attack.
Check the domain name of the supplier. Has it been altered in any way? A classic alteration would be to register an identical domain to (for example) Remain.com as Rernain.com. In some fonts and in an email address, the rn would look very similar to an m.
Typically, the attacker will register a domain very similar to yours, another very similar to your customer and create edited traffic inbetween.
Check the domain name of the supplier. Has it been altered in any way? A classic alteration would be to register an identical domain to (for example) Remain.com as Rernain.com. In some fonts and in an email address, the rn would look very similar to an m.
Typically, the attacker will register a domain very similar to yours, another very similar to your customer and create edited traffic inbetween.
Ronstein said:
Sounds like either the supplier's email is compromised or it's a 'man in the middle' attack.
Check the domain name of the supplier. Has it been altered in any way? A classic alteration would be to register an identical domain to (for example) Remain.com as Rernain.com. In some fonts and in an email address, the rn would look very similar to an m.
Typically, the attacker will register a domain very similar to yours, another very similar to your customer and create edited traffic inbetween.
The altered emails just have a return address to a gmail account. The name of the person of the supplier is correct but the return address "underneath" it is different. Check the domain name of the supplier. Has it been altered in any way? A classic alteration would be to register an identical domain to (for example) Remain.com as Rernain.com. In some fonts and in an email address, the rn would look very similar to an m.
Typically, the attacker will register a domain very similar to yours, another very similar to your customer and create edited traffic inbetween.
If you're using an email client (like Outlook etc) I think you'll need to log in to your account online at https://outlook.live.com (it's Outlook now, Hotmail hasn't existed for years).
Then go the settings, then All Settings, and look at Rules and, I think Sweep, and likely something will have been set to foward certain emails to the fraudsters and divert the original email to archive.
Then go the settings, then All Settings, and look at Rules and, I think Sweep, and likely something will have been set to foward certain emails to the fraudsters and divert the original email to archive.
Log in in to your Outlook/Hotmail account & check that things like the recovery email address & phone number haven't been changed. If they are still yours then reset the password & enable 2FA then check for processing rules as above.
Off topic but Hotmail for a business? I'd look at a 365 account (& yes I know Exchange was compromised recently).
Off topic but Hotmail for a business? I'd look at a 365 account (& yes I know Exchange was compromised recently).
Sheepshanks said:
If you're using an email client (like Outlook etc) I think you'll need to log in to your account online at https://outlook.live.com (it's Outlook now, Hotmail hasn't existed for years).
Then go the settings, then All Settings, and look at Rules and, I think Sweep, and likely something will have been set to foward certain emails to the fraudsters and divert the original email to archive.
Cool, cheers. Yes, someone had set that and a few other emails to be forwarded to the scammers address!Then go the settings, then All Settings, and look at Rules and, I think Sweep, and likely something will have been set to foward certain emails to the fraudsters and divert the original email to archive.
AJL308 said:
Sheepshanks said:
If you're using an email client (like Outlook etc) I think you'll need to log in to your account online at https://outlook.live.com (it's Outlook now, Hotmail hasn't existed for years).
Then go the settings, then All Settings, and look at Rules and, I think Sweep, and likely something will have been set to foward certain emails to the fraudsters and divert the original email to archive.
Cool, cheers. Yes, someone had set that and a few other emails to be forwarded to the scammers address!Then go the settings, then All Settings, and look at Rules and, I think Sweep, and likely something will have been set to foward certain emails to the fraudsters and divert the original email to archive.
Related but unrelated.
I’ve been setting up some rules to keep stuff tidy, so emails from eBay say, go to eBay folder.
As per this thread, it’s easy to not spot stuff getting moved to not the inbox.
The problem on my iPhone is there is only a way to view all inboxes, or sub-folders bt navigating to them.
From what I can tell no alert at all is made to say a new email has arrived, unless it lands in the inbox without rules.
In my case, and in the OP case, it seems you’d spot this truck right away if a ‘new’ email wherever it went, was alerted.
Or am I being a bit dim in what I’m wanting to happen? Maybe I can let the rules run after an email is so old?
I’ve been setting up some rules to keep stuff tidy, so emails from eBay say, go to eBay folder.
As per this thread, it’s easy to not spot stuff getting moved to not the inbox.
The problem on my iPhone is there is only a way to view all inboxes, or sub-folders bt navigating to them.
From what I can tell no alert at all is made to say a new email has arrived, unless it lands in the inbox without rules.
In my case, and in the OP case, it seems you’d spot this truck right away if a ‘new’ email wherever it went, was alerted.
Or am I being a bit dim in what I’m wanting to happen? Maybe I can let the rules run after an email is so old?
Brother D said:
AJL308 said:
Sheepshanks said:
If you're using an email client (like Outlook etc) I think you'll need to log in to your account online at https://outlook.live.com (it's Outlook now, Hotmail hasn't existed for years).
Then go the settings, then All Settings, and look at Rules and, I think Sweep, and likely something will have been set to foward certain emails to the fraudsters and divert the original email to archive.
Cool, cheers. Yes, someone had set that and a few other emails to be forwarded to the scammers address!Then go the settings, then All Settings, and look at Rules and, I think Sweep, and likely something will have been set to foward certain emails to the fraudsters and divert the original email to archive.
I know some had been pestering for some type of flag/alert which means you won’t have to dig to find rules like this.
Haven’t seen any changes tho.
It's known as mandate fraud and it's very common at the moment. It usually works as follows:
1) scammer sends out phishing emails, either targeted or at random - businesses, and particularly those in finance or accounts departments are key targets
2) victim falls for email, such as a fake Office 365 notification; they 'log in' to a fake page thereby giving up their credentials
3) scammer logs in to victim's account, looks around, sets up forwarding rules and monitors activity
4) scammer either sends out emails direct from victim's account to customers requesting payment to a new bank account or sets up a website with a very similar name and does the same from an email account they control entirely
5) further victims are taken in by these new payment details and make payments to account belonging to money mules
6) scammers target new victims identified from interactions with the initial victim
The best ways to avoid this are:
1) Use strong, unique passwords
2) Use two factor authentication
3) Keep software up-to-date
4) Remain vigilant for unexpected login requests and similar phishing scams
5) If you're in a role involving payments, always check new payment details via a second method, such as a phone call
Lots of good advice here: https://www.ncsc.gov.uk/search?q=phishing
1) scammer sends out phishing emails, either targeted or at random - businesses, and particularly those in finance or accounts departments are key targets
2) victim falls for email, such as a fake Office 365 notification; they 'log in' to a fake page thereby giving up their credentials
3) scammer logs in to victim's account, looks around, sets up forwarding rules and monitors activity
4) scammer either sends out emails direct from victim's account to customers requesting payment to a new bank account or sets up a website with a very similar name and does the same from an email account they control entirely
5) further victims are taken in by these new payment details and make payments to account belonging to money mules
6) scammers target new victims identified from interactions with the initial victim
The best ways to avoid this are:
1) Use strong, unique passwords
2) Use two factor authentication
3) Keep software up-to-date
4) Remain vigilant for unexpected login requests and similar phishing scams
5) If you're in a role involving payments, always check new payment details via a second method, such as a phone call
Lots of good advice here: https://www.ncsc.gov.uk/search?q=phishing
Mr Whippy said:
Related but unrelated.
I’ve been setting up some rules to keep stuff tidy, so emails from eBay say, go to eBay folder.
As per this thread, it’s easy to not spot stuff getting moved to not the inbox.
The problem on my iPhone is there is only a way to view all inboxes, or sub-folders bt navigating to them.
From what I can tell no alert at all is made to say a new email has arrived, unless it lands in the inbox without rules.
In my case, and in the OP case, it seems you’d spot this truck right away if a ‘new’ email wherever it went, was alerted.
Or am I being a bit dim in what I’m wanting to happen? Maybe I can let the rules run after an email is so old?
If using Outlook client (program on your computer) then there's a couple of alert options in Rules. Those rules will only run once Outook is opened though, so anything that came into your iPhone in the meantime would go into the Inbox. It would be moved automatically once you opened Outlook.I’ve been setting up some rules to keep stuff tidy, so emails from eBay say, go to eBay folder.
As per this thread, it’s easy to not spot stuff getting moved to not the inbox.
The problem on my iPhone is there is only a way to view all inboxes, or sub-folders bt navigating to them.
From what I can tell no alert at all is made to say a new email has arrived, unless it lands in the inbox without rules.
In my case, and in the OP case, it seems you’d spot this truck right away if a ‘new’ email wherever it went, was alerted.
Or am I being a bit dim in what I’m wanting to happen? Maybe I can let the rules run after an email is so old?
I've no idea if this capability exisits in other email clients.
Mr Pointy said:
Off topic but Hotmail for a business? I'd look at a 365 account (& yes I know Exchange was compromised recently).
IIRC, the vulnerable Exchange was the (usually run by organisations on-prem) Exchange server software, not Exchange Online which is what's behind Microsoft 365.Marshy said:
Mr Pointy said:
Off topic but Hotmail for a business? I'd look at a 365 account (& yes I know Exchange was compromised recently).
IIRC, the vulnerable Exchange was the (usually run by organisations on-prem) Exchange server software, not Exchange Online which is what's behind Microsoft 365.
Gassing Station | Computers, Gadgets & Stuff | Top of Page | What's New | My Stuff