topic Re: Phishing scam in Security

Phishing scam

Durian1 — Thu, 24 Jul 2025 08:28:36 GMT

I received an email from TalkTalk this week advising about the new dashboard layout and taking more control of my account. I clicked on my saved shortcut in safari to sign into my account but got an error message. So I tried the link on the mail and it took through ok and all the data looked genuine. However when I was navigating it advised there was a technical error and I signed out. After that I struggled to sign in being advised it was a technical error. However I managed to sign in with Google Chrome.

When I tried signing in from my iPhone on safari I got a warning on Microsoft Defender that it had blocked a phishing link cdn.polyfill.io. I tried logging in on Google Chrome on my iPhone and got the same warning. The account appeared OK. I called TalkTalk security and they said change your password which I did but its made no difference. They couldn't find any problems and denied the link was coming from them. Sometimes if I sign in on my laptop I have a message saying due to technical problems I can't sign in but yet I can see my account page behind this. I have scanned my MacBook for malware and nothing was found. iPhones I am told should be OK and MS defender is blocking the link. Does anyone else have any ideas or similar issues?

Re: Phishing scam

fr8ys — Thu, 24 Jul 2025 10:21:20 GMT

You should be very wary of emails purporting to be from TalkTalk that contain links.

If in doubt, don't use them but sign in from your own trusted bookmarks.

Changing your passwords are essential and if you use the same combination, i.e email address and password to sign in in any other sites, change those passwords too.

It sounds like you are using a pc too. If so rye a full virus scan of that and a malware scan is recommended. I use the free version of malwarebytes.

Re: Phishing scam

nambuso-TT — Thu, 24 Jul 2025 10:24:58 GMT

Thanks for advising @fr8ys

Re: Phishing scam

Divsec — Thu, 24 Jul 2025 10:25:22 GMT

Hi @Durian1 your post has been escalated.

Are your safari / apple apps up to date? The issue points to malware which was neutralised last year.

Re: Phishing scam

fr8ys — Thu, 24 Jul 2025 10:33:11 GMT

Also if you hover over the link it will probably show as a non TalkTalk address. If that's so just delete the mail.

TalkTalk have requested that spam mail be reported to them.
How to do this can be found here
https://community.talktalk.co.uk/t5/Articles/Phishing-emails-amp-everything-you-need-to-know/ta-p/3002256.
Thank you.

Re: Phishing scam

Durian1 — Thu, 24 Jul 2025 12:25:18 GMT

Yes my apps on my iPhone are up to date and hat's where I get the MS Defender notification

Re: Phishing scam

Durian1 — Thu, 24 Jul 2025 12:27:53 GMT

TalkTalk confirmed they sent me the email and there was nothing unusual about it. It addressed me with my name. I know other users who have had the same email so its genuine. I have scanned my MacBook with the TalkTalk Safe software on line and no reports of anything untoward

Re: Phishing scam

Durian1 — Thu, 24 Jul 2025 12:29:38 GMT

I was wary of the email at first which is why I went straight to the TalkTalk web site to sign in

Re: Phishing scam

Durian1 — Thu, 24 Jul 2025 12:31:43 GMT

Re: Phishing scam

Divsec — Thu, 24 Jul 2025 12:33:11 GMT

Hi @Durian1 starting to sound like a bit of TT not keeping their settings right up to date.

Your checks have been very thorough and for what it's worth I would feel reassured and secure.

Re: Phishing scam

Durian1 — Fri, 25 Jul 2025 07:32:30 GMT

Hi Nambuso-TT

Do you know if TT will be investigating this cdn.polyfill.io issue? It’s been very stressfull investigating only to find the likely issue could be with TT. If so then poor housekeeping on TT’s behalf.
please advise

Re: Phishing scam

nambuso-TT — Fri, 25 Jul 2025 10:11:54 GMT

Hi there @Durian1 I am very sorry to hear this. Please confirm if the email you received was from TalkTalk?

Re: Phishing scam

Durian1 — Sat, 26 Jul 2025 06:50:31 GMT

Hi ambush-TT

Yes it was from TT regarding the new dashboard layout and taking more control yourself of your account. I spoke to someone in the customer support and they confirmed they sent the email. I also know someone else who received the same email. Both emails were personalised using our respective first names which I believe is a good flag from the advice TT publish about potential phishing emails. Ie suspicious emails are usually impersonal.

Re: Phishing scam

Durian1 — Sat, 26 Jul 2025 06:52:04 GMT

apologies typo on your name nambuso-TT on last post 😬

Re: Phishing scam

siphosethu-TT — Mon, 28 Jul 2025 07:23:49 GMT

Hi there @Durian1, if you get any scam email, please use the link below advising you how you go about handling phishing emails. Thanks

Phishing emails - everything you need to know

Re: Phishing scam

Durian1 — Mon, 28 Jul 2025 15:53:54 GMT

Hi siphosethu-TT

It turned out not to be a phishing scam as explained in all my other posts. Your technical on line support confirmed the email came from TT. Also I have seen the same emails to other users about your new dash board layout.
It seems to me that your website is issuing a legacy link to cdn.polyfill.io which other posts seem also think is possible. Please can someone check the website and do a thorough trawl to remove the link if there. Please advise

Re: Phishing scam

siphosethu-TT — Mon, 28 Jul 2025 16:02:23 GMT

There's not much we can do in our end, but I'll escalate to see if that's possible. Thanks