Another Scam?

[Chris Parks]

I tried to ask Telstra this but they don't want to speak on the phone anymore and just disconnected the phone call. I received an email this morning and wondered if anyone else has received one. The reference numbers in the text mean nothing to me and do not appear on the last invoice which has been paid anyway. I found the email in my spam folder but without the usual Gmail alert for such things. The other missing detail is Telstra won't accept my CC for payment and it has to be done by direct payment so I guess they don't know that. I think it is a really good attempt though and they get some points for the presentation and formatting.

Opera Snapshot_2020-09-21_131831_mail.google.com.png

[markharrison]

I would say you are probably right.

It would be interesting to see the raw source for the email along with the email headers.

×

[Chris Parks]

Is this enough? If not how do I get more from a Gmail?

from:		Support via spotlead.com
reply-to:		[email protected]
to:
date:		21 Sep 2020, 09:38
subject:		Telstra : invoice # INT 14437201922.
Signed by:		spotlead.com
security:		Standard encryption (TLS) Learn more

[Chris Parks]

I would say you are probably right.

It would be interesting to see the raw source for the email along with the email headers.

Mark, I can send it to you if that helps. It seems such a good thing I bet a lot of people fall for it. I checked my bank statements and the last invoice before I was convinced it was a scam. There was an alert from Gmail which I did not read fully so I can't say I wasn't warned.

[markharrison]

Hi Chris,

I recommend removing your obviously real email address from that post...

If you click the "Show Original" (see below) you will get the original source along with the headers.

Probably best send this as a PM. There will be identifying information in there you don't want to share with the internet.


×

[david.elliott]

For me the incorrect capitalisation would be a giveaway...
AND is seems like that title for Fiona is an old role she held.

[COLOR=rgba(0, 0, 0, 0.9)]"Fiona's current role as Head of Telstra Retail and Regional involves leading the Retail Store Network Nationally in Telstra Consumer and Small Business. Fiona’s former role was Executive Director of Global Contact Centres."[/COLOR]

[ian]

Is this enough? If not how do I get more from a Gmail?

from:		Support via spotlead.com
reply-to:		[email protected]
to:
date:		21 Sep 2020, 09:38
subject:		Telstra : invoice # INT 14437201922.
Signed by:		spotlead.com
security:		Standard encryption (TLS) Learn more

Chris, it's definitely a scam email.
the reply address is not a Telstra email address
the signature is not a Telstra signature

I know you are too smart to click on the link.

[Simplicity]

That signature
And sign off look very odd.

Cheers Matt.

[markharrison]

For me the incorrect capitalisation would be a giveaway...
AND is seems like that title for Fiona is an old role she held.

[COLOR=rgba(0, 0, 0, 0.9)]"Fiona's current role as Head of Telstra Retail and Regional involves leading the Retail Store Network Nationally in Telstra Consumer and Small Business. Fiona’s former role was Executive Director of Global Contact Centres."[/COLOR]

At Planet Marketing; that capitalisation would be considered normal.

The sort of thing I was looking for in the headers would be this sort of thing which showed the path the email took

Received: from unknown (HELO ipbavi.tcif.telstra.com.au) ([10.97.217.199]) by ipocvi.tcif.telstra.com.au with ESMTP; 11 Oct 2019 14:15:02 +1100
Received: from wsapp5584.srv.dir.telstra.com ([10.75.131.20])
by ipcavi.tcif.telstra.com.au with ESMTP; 11 Oct 2019 14:15:01 +1100
Received: from wsapp5873.srv.dir.telstra.com (10.75.11.109) by wsapp5584.srv.dir.telstra.com (10.75.131.20) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Fri, 11 Oct 2019 14:14:54 +1100
Received: from wsmsg3754.srv.dir.telstra.com (172.49.40.198) by wsapp5873.srv.dir.telstra.com (10.75.11.109) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Fri, 11 Oct 2019 14:14:53 +1100
Received: from localhost (10.117.205.21) by ties-smtp.in.telstra.com.au (172.49.40.198) with Microsoft SMTP Server id 8.3.485.1; Fri, 11 Oct 2019 14:14:42 +1100
From:
Reply-To:

They can be faked but the scammers rarely bother. This sample was from a real Telstra email.

The other giveaway is any links in the email. They will direct you to their fake website and will not end in (to use this example) telstra.com.


×

[russ57]

from: Support via spotlead.com

reply-to: [email protected]

Alone is sufficient to spell
DANGER WILL ROBINSON
to coin a phrase..

See Scam Email



-russ

[droog]

Similar ones have been sent for other ISP’s, I got one the other day supposedly for my ISP but not the email that they send account information to. Same error for payment.

Hover over the link on the page, don’t click it just hover your mouse over it, you will see the address that the link intends to take you too it won’t be telstra.com

Report it to Telstra as a phishing email.
Telstra - Help - Cyber Scams

[elanjacobs]

Any real email will be addressed to you by name, NEVER "Dear Customer"

[Chris Parks]

These things are not much of a danger to those familiar with this stuff and most who have responded fall into that category but for everyone else it is easy to see how they get deceived and I posted this in an efort to alert those who fall into the latter category. Thanks to those who have responded they might be more alert and better educated on what not to do. Never click on a live link in any email is the best advice but it took me a few seconds to realise what was going on. What really annoys me is Testra don't want to talk to anyone on the phone if they can avoid it and if your call does not fall into their menu system they simply disconnect your call but that is a conversation for another day.

[ian]

What really annoys me is Testra don't want to talk to anyone on the phone if they can avoid it and if your call does not fall into their menu system they simply disconnect your call but that is a conversation for another day.

Telstra does want to know, it's just that the attempted scammer sent an email so Telstra wants you to report the incident on-line using
REPORT MISUSE OF SERVICE

and you could also try the acma Online enquiries | ACMA -- the .gov.au is a fairly good assurance that the acma's website is sort of OK.
Note that I haven't done much more click on a few links on the ACMA's web site to get to the linked page




also note
Although Telstra's call centre may no longer be located off shore -- something I don't really know for sure -- the call center "operators" will not be trained in how to respond to scam or phishing emails. That's why Telstra's web site gives a link to their "report misuse of service" on-line form

[Chris Parks]

Telstra does want to know, it's just that the attempted scammer sent an email so Telstra wants you to report the incident on-line using
REPORT MISUSE OF SERVICE

and you could also try the acma Online enquiries | ACMA -- the .gov.au is a fairly good assurance that the acma's website is sort of OK.
Note that I haven't done much more click on a few links on the ACMA's web site to get to the linked page




also note
Although Telstra's call centre may no longer be located off shore -- something I don't really know for sure -- the call center "operators" will not be trained in how to respond to scam or phishing emails. That's why Telstra's web site gives a link to their "report misuse of service" on-line form

Call me old fashioned but I want to talk to someone when I call a help desk phone number.