Aer Lingus/twelvehorses phishing attempt?

Sarsfield

Not sure which is the best forum for this question.

I got an email this evening claiming to be from Aer Lingus relating to a recent booking I made (I did book a flight last week)

The email came from aerlingus@aerlingus.com.r.12hs.com and claims to have detected a fraud attempt on Aer Lingus online customers. It looks like a typical Aer Lingus html email (links to cars, hotels etc), but all the links appear to go to twelvehorses

It looks decidedly dodgy, particularly as the destination email address isn't mine! Nor does it refer to me by name or mention the flight I booked.

Has anyone had anything similar?

Edited to suggest it is my email scanner that thinks it's dodgy. Probably 'cos it IS twelvehorses but advertises itself as Aer Lingus. Good old AVG! But why would a genuine email have a title 'Your recent booking'? Such a vague title makes is look like a phishing attempt!

Occidental

I've been receiving mailshots from Aer Lingus with twelvehorses links for at least the last two years. Set off a few alarm bells at first, but just seems to be standard ad's/offers.

Bard

Twelve Horses is an Irish company that provides email and web-based marketing and business automation solutions for other companies. Aer Lingus obviously have no method of doing this on their own and so have been using Twelve Horses to do their e-mailshots for quite some time now. If you bothered to look at the Twelve Horses site you would see that Aer Lingus are on their clients list.

And the destination address isn't yours? ... Wow. Nothing amazing there. You're on a mailing list. The destination address is the mailing list.

BuffyBot

Would a marketing company have anything to do with "fraud attempts"? Might be worth checking out with Aer Lingus on the phone.

Sarsfield

Bard wrote:

Twelve Horses is an Irish company that provides email and web-based marketing and business automation solutions for other companies. Aer Lingus obviously have no method of doing this on their own and so have been using Twelve Horses to do their e-mailshots for quite some time now. If you bothered to look at the Twelve Horses site you would see that Aer Lingus are on their clients list.

And the destination address isn't yours? ... Wow. Nothing amazing there. You're on a mailing list. The destination address is the mailing list.

Thank you. I know of twelverhorses. I know Aer Lingus uses them. I've been getting their mail for years. If you bothered to read my message you'd know that wasn't my question. My initial concern was that it wasn't twelvehorses, but rather someone pretending to be twelverhorses/Aer Lingus. Note the reference to 'attempted fraud' in the message.

Anyway, I realised it was actually my av/firewall was the issue. It changed the title of the first link to 'Possible fraud attemt detected' in big red letters. This was also noted in the edit to the message you replied to

BrianD

There was quite a debate about this some time ago where somebody (ridiculously) suggested that they were being spammed by Aer Lingus despite the fact they were an Aer Lingus customer.

However, it would be unusual for Aer Lingus (or their service provider - 12 Horses) to ask for your password. It's quite possible that the next wave of phishing attempts might be aimed at those who use airline travel sites (we've had all the banks, eBay, PayPal etc). People might have a lower security threshold when it comes to something like an airline (as opposed to a bank). Fortunately, Aer Lingus does ask you for your credit card again if you makes changes or new bookings. However, there is plenty of personal info in your registration that might assist fraudulent behaviour or identity theft.

Victor

I think it odd for an e-mail to be issued like that, someone asked me about it yesterday and my advice then, as it is now is to contact your credit card company directly by phone and never reply to an e-mail like that.

BrianD

Without having seen the e-mail it does sound like a phishing attempt. As I said, perhaps the customers of airlines are the latest targets. No doubt, British AIrways, RyanAir, Air Iraq will all be asking me to log in before my flights and airplane will be deleted.

All of these airlines use real time credit card processing. If your card is rejected you know immediately. You can still go back to the aer lingus site (enter the URL yourself don't follow the link from the e-mail) enter your booking reference and check the status of your flight booking. If in doubt, err on the side of caution.

Sarsfield

I've attached a screen grab of the offending message. I know it wasn't a phishing attempt, but the big red messages with the word 'fraud' in them had me jumping to conclusions.

BuffyBot

So the mail itself isn't about fraud? Just MailScanner telling you it's fraud?

It think MailScanner is just being a bit over zealous by the looks of it - just because the links etc point to twelvehorses (so they can measure click-through rates) before directing you on to Aer Lingus.

lostinsuperfunk

somebody (ridiculously) suggested that they were being spammed by Aer Lingus despite the fact they were an Aer Lingus customer

That was me - but I claimed I was being spammed by 12horses, not Aer Lingus, and I wasn't aware of having opted in to anything. For the record, I unsubscribed via the 12hs link supplied in the emails and the Aer Lingus junk promptly stopped. So I admit I falsely accused 12hs of spamming me.

However, this new thread shows that it was not as ridiculous as BrianD suggests. To the OP, it is unlikely that this is a phishing attempt, it is just the combined ineptitude of 12hs and Aer Lingus that makes it look like that. The use of links labelled 'Aer Lingus' but redirecting to 12horses (and other stupid devices) makes it appear fraudulent and that is why MailScanner flags it.

BrianD

Sounds to me that Mailscanner is a piece of junk and caused undue "stress" to the original poster. Furthermore the actual e-mail did not remotely look like a phishing attempt.

Many reputable companies use third parties to handle their web and e-mail activity. There is certainly no ineptitude by AL or 12H ... you probably subscribed to the mailing list yourself and forgot about. The fact is when you unsubscribed the e-mails stopped as you would expect.