topic Re: Keep alert! in Email

Keep alert!

Gliwmaeden2 — Fri, 22 Sep 2023 08:27:46 GMT

Scammers are exploiting the recent upgrade / migration of emails and sending out plausible looking information to customers.

Don't click on any links asking you to refresh your service!

Details of the correct webmail link are found in Talktalk's own information pages, here:

https://community.talktalk.co.uk/t5/Webmail-Update/bd-p/webmailupdate

Re: Keep alert!

Karl-TalkTalk — Fri, 22 Sep 2023 08:33:44 GMT

Our security teams are working to block any email or links they identify, so if you do think you have received a suspect email, please report this to phishing@talktalk.co.uk

Help with Phishing emails - TalkTalk Help & Support

Thanks

Karl.

Re: Keep alert!

Pash02 — Fri, 22 Sep 2023 08:48:39 GMT

I have just reported mine to report@phishing.gov.uk but will send to TT also now

Thanks

Scam

Re: Keep alert!

Karl-TalkTalk — Fri, 22 Sep 2023 08:49:53 GMT

Excellent.

Karl.

Re: Keep alert!

td123 — Fri, 22 Sep 2023 11:25:25 GMT

@Gliwmaeden2 @Karl-TalkTalk @Pash02

I have also forwarded mine to phishing@talktalk and to report@phishing.gov.uk but it won't be that easy as (no surprises) the scam mails aren't coming from just one address, mine was from gary.mcglouglin @tiscali.co.uk whereas others report them from mannelic @talktalk & helenarandles@ tiscali.co.uk and no doubt there will be many more so blocking them all will be a full time job..

Re: Keep alert!

Gliwmaeden2 — Sun, 24 Sep 2023 19:10:02 GMT

A quick reminder of what the true Talktalk email looks like, ahead of migrating:

Rather worryingly, no attempt is made to address the customer by name, so this actually looks more like a scam. This one is not.

However we have learnt this evening of a recent phishing email where the sender has gone out of their way to personalise the email, addressing the customer by name.

So these checks and balances are not watertight. ....!

Then, more similar wording. This is the original true Talktalk version:

The follow up email looks like this:

Subsequent sections contain links:

@Karl-TalkTalk, grateful if you could feedback to the sender of the authentic emails that the presentation does not lend itself to good security practice.

Simply using "Hi" .... banks tend to use a postcode which is better even than a name.

Too many links that may tempt customers to click through, rather than err on the side of caution. While the genuine email won't cause harm, it doesn't represent best practice. The lure of promoting the upgraded email appears to have distracted from presentating a simple recommendation to explore directly from within webmail itself, accessed from a known Talktalk website page.

Whoever is behind the phishing scam is exploiting this rather lax standard of presentation. The fake Talktalk messages are very convincing lookalikes. All that customers can go by really is hovering over the sender's name and not clicking on any links, regardless of what they supposedly take us to.

Re: Keep alert!

Gliwmaeden2 — Mon, 02 Oct 2023 08:05:15 GMT

@Karl-TalkTalk, the link you posted at the foot of your original reply is not currently taking me to the support article.

Got a similar email today which I have reported, purporting to come from the Halifax. Have forwarded it to phishing at Talktalk.

They are now inserting "update information" rather than "refresh" in something that looks like an authentic message from the Halifax, so all very plausible except banks don't do it this way and it comes from "lemmyv@tiscali.co.uk".

Also a give away exclamation mark in the title.

Re: Keep alert!

Karl-TalkTalk — Mon, 02 Oct 2023 08:36:42 GMT

Just tested the link, it was a bit slow loading, but did eventually open the link to the phishing content page.

Karl.

Re: Keep alert!

Gliwmaeden2 — Mon, 02 Oct 2023 08:42:23 GMT

Ah yes! At least 15 seconds.....

I notice that sometimes the search engine is very slow to respond too, @Karl-TalkTalk, but don't usually have this issue with links within a thread etc.

In fact putting a query directly into the search engine is usually slightly sticky, but not as much as this!

Re: Keep alert!

Karl-TalkTalk — Mon, 02 Oct 2023 08:44:34 GMT

I'll have to feed the hamster 🙂

Karl.

Re: Keep alert!

Gliwmaeden2 — Fri, 13 Oct 2023 22:31:17 GMT

Talktalk still not blocking this sort of variant of the "refresh your contact" phishing scam, despite it being reported previously. Gmail always spots it.

Talktalk could do better.

I've reported it to the government site for phishing reports, but won't bother sending it to Talktalk as they never acknowledge it.

Re: Keep alert!

Gliwmaeden2 — Fri, 16 Feb 2024 13:38:25 GMT

Another one to report as Spam/ phishing (TalkTalk let it slip through):