AIB fraudulent email

netman

Folks,

I just got an email in my mailbox this morning from a scammer that appears like a legitimate AIB email informing the user of an upgrade and asking them to confirm their details.

Everything looks pretty normal to an average user, and the address is masked to appear as if it's www.aib.ie but actually takes the user to a server on IP address 62.142.239.81.

I've emailed AIB tech support through their online form, but knowing how things work there I wouldn't expect them to do anything about it anytime soon. So AIB banking users beware.

The image looks like this (see attachment)

seamus

Yeah, it's a scam. Been going around for a while now, hundreds of banks' customers have been getting similar mails.

I wonder where they get the addresses for AIB customers specifically though (i.e. why hasn't a BOI customer gotten such an email asking them to confirm their AIB details?)

Right-click on the link in the mail, choose "copy shortcut" and post up the URL here. I'd be interested to know exactly where they're directing people.

grumpytrousers

The language is a giveaway, innit, though...."we EARNESTLY ask"...etc...The last time I was asked 'earnestly' to do something was to help that nice Nigerian gentleman move some money out of the country....

netman

Well, I'm a BOI customer, so the email bears no significance to me, but knowing how silly average internet users are, they'll probably click on it and send their details to a scammer and then wonder how come their bank account was emptied out overnight.

This is the URL that the email link takes you to:
http://62.142.239.81:87/%61/%69%6E%64%65%78%2E%68%74%6D

Hobbes

Probably got hold of a mailing list supplied by AIB. Or hacked AIB.

I get numerous of those eBay ones, but I don't use eBay at all.

fintan

there is a big warning on the AIB website about this

Fionn

hmmm the URL given by NETMAN seems to 404 for me!
Obviously they've moved on, i guess they only stay for short periods.

trace reveals:
inetnum: 62.142.236.0 - 62.142.239.255
Canonical name: YMMMDCCCLXXXI.dsl.saunalahti.fi
netname: SCIFI-NET
descr: Saunalahti Group OYJ
descr: (Old name: Jippii Group OYJ)
descr: (Old name: Saunalahden Serveri)
descr: (Old name: Scifi Communications int. Oy)
descr: Linnoitustie 4 B, 02600 Espoo
descr: Finland
country: FI
admin-c: EUFI-RIPE
tech-c: EUFI-RIPE
status: ASSIGNED PA
mnt-by: AS6667-MNT
notify: registry@sci.fi
changed: mika.ruohotie@eunet.fi 20040303
source: RIPE

I presume they just spam this mail from a mailing list or whatever they've acquired, since NETMAN isn't an AIB customer it's safe to assume they didn't get a customer list.

Hobbes

Hardly. If the hacker is a professional thief (which we must suspect they are), odds on that information is either.

- Fake
- Put using a fake/stolen credit card
- Owners have their site hacked.

jessy

Got one of the bastids as well. Although I'm BOI so i new straight off it was a scam.

parsi

I have been getting similar ones relating to my ebay and paypal accounts. Funnily I only get them to the address I use for ebay and this is a non-published and non-guess addressed. I would have expected to also get them on some of my addresses which have been subject to spam . From work I notice that we don't seem to be getting the ebay spam or indeed the aib one but we do get a lot of the Barclays, citibank etc versions and usually to the same old dead addresses.