topic Re: Refresh Activation - Is this a scam? in Email

Refresh Activation - Is this a scam?

td123 — Fri, 22 Sep 2023 10:17:16 GMT

Hi All, I recieved an e.mail today from a gary.mcglouglin@ tiscali.co.uk with the title "TalkTalk - Refresh Activation!" (Screenshot attached) within the e.mail is a button to Refresh Your Account and another link providing more info .

I know there is the big upgrade coming and this could well be legit with but as this e.mail has not come from the recognisable info.customer @talktalk.co.uk I wanted to check before clicking on any link/button. It looks like a TalkTalk communication - but we all know that doesn't mean it IS from TalkTalk and an announced upcoming mailbox upgrade could be an ideal opportunity for scammers to harvest lots of personal data.

Regards

td123

Re: Refresh Activation ?

Gliwmaeden2 — Fri, 22 Sep 2023 08:19:22 GMT

It's a good imitation by a scammer, @td123.

To actually sign into webmail, only ever use Talktalk's website links.

Current information on the upgrade is here:

https://community.talktalk.co.uk/t5/Webmail-Update/bd-p/webmailupdate

Re: Refresh Activation ?

Pash02 — Fri, 22 Sep 2023 08:45:06 GMT

I was going to ask the same question

I have sent mine to report@phishing.gov.uk Scam?

Re: Refresh Activation ?

td123 — Fri, 22 Sep 2023 10:12:51 GMT

@Gliwmaeden2 So we were right to be wary. Many thanks for the confirmation. Might it not be a good idea for TalkTalk to send out an e.mail to all subscribers warning that this scam is happening and not to engage?

@Pash02 Great minds think alike!

td123

Re: Refresh Activation - Is this a scam?

Floydoid — Fri, 22 Sep 2023 10:40:32 GMT

I got a similar mail this morning from the address keddod@talktalk.net.

Re: Refresh Activation ?

Gliwmaeden2 — Fri, 22 Sep 2023 10:44:44 GMT

Yes, it would.

I posted a topic for people to be alert to the issue but don't know how to turn it into a sticky notice.

Nothing showing in the Service Status Dashboard either, but I know staff are aware.

Re: Refresh Activation - Is this a scam?

Floydoid — Fri, 22 Sep 2023 11:07:13 GMT

I've had phishing / scam stuff before from the alleged talktalk.net domain. If you're savvy and check the details of the originating email address that soon tells you if it is a scam or genuine. Hovering over any links helps too - if they look like nonsense, then they probably are

Re: Refresh Activation - Is this a scam?

fr8ys — Sun, 24 Sep 2023 18:01:46 GMT

My wife has had one today.

Strangely, unlike the screenshots here that just say Hi, my wife's says Hi then her full name, not contracted and not the email address.

The full name is used only as the name on the email. It does not show within the email address

Have the emails been hacked to be able to show the name?

The actual sender is austinanderton @ tiscali .co .uk

Re: Refresh Activation - Is this a scam?

Gliwmaeden2 — Sun, 24 Sep 2023 18:23:56 GMT

A very worrying development, @fr8ys.

One does wonder if there's been what could be a catastrophic security lapse. I'll re-escalate this, as it's a new aspect.

Re: Refresh Activation - Is this a scam?

Ady-TalkTalk — Mon, 25 Sep 2023 10:15:48 GMT

Hi td123, that will be a spoofed email address. Do you know how you check the mail header to identify the real sending information?

Ady

Re: Refresh Activation - Is this a scam?

fr8ys — Mon, 25 Sep 2023 11:15:52 GMT

@Ady-TalkTalk I know I should probably have started my own thread, but didn't want to put the screenshot on the open forum showing my Wife's details.

If they can now insert a person's name into a scam mail that is a worrying thought going forward as it is one of the safety things people look for on a scam e-mail.

I have sent it to you in a PM.

Steve

Re: Refresh Activation - Is this a scam?

Gliwmaeden2 — Mon, 25 Sep 2023 12:02:48 GMT

Strangely, @fr8ys, the original authentic Talktalk emails notifying us about the upgrade etc were not personalised. They just began "Hi".

Very poor practice! But it means that your wife's one stands out as being different from both Talktalk's own and the scam that most recipients appear to have had.

For the scam to be so "on topic" and a plausible spoof, and all the "senders" names indicating that the scammer is aware of the range of Talktalk / Tiscali etc that Talktalk covers, it's very worrying that this is not an amateur job.

Re: Refresh Activation - Is this a scam?

Geoff15 — Mon, 25 Sep 2023 12:18:10 GMT

I've fallen for this scam. The email came from <chazclark@tiscali.co.uk> and foolishly I clicked on the Refresh Your Account button. It came through recently with a legitimate TalkTalk email reminding me that my Fibre contract was coming to an end soon, so I guess my guard was down. I've forwarded the scam email to phishing@talktalk.co.uk and report@phishing.gov.uk

Re: Refresh Activation - Is this a scam?

td123 — Mon, 25 Sep 2023 12:42:02 GMT

@Ady-TalkTalk - Maybe, but please describe method so that I and other readers will have the info.

@Geoff15 - Probably a good idea to change your passwords to be on the safe side.

Re: Refresh Activation - Is this a scam?

Geoff15 — Mon, 25 Sep 2023 13:45:34 GMT

Thanks @td123 - Yes I've updated my password, which was a bit of a faff. It has to be reset through talktalk webmail rather than MyAccount, which would seem to be the obvious place for a reset. Once the p/w is updated in webmail it automatically updates My Account.

Re: Refresh Activation - Is this a scam?

Ady-TalkTalk — Wed, 27 Sep 2023 05:34:54 GMT

If you want to verify the source of the email. Click on the 3 dots above the mail and click on view source.

This will show you the genuine mail sender. Please send the mail header to me via private message. I should add that I'm already working with security and the email project to stop this. We only send mail from 1 address and its not a name at tiscali or talktalk.

Ady

Re: Refresh Activation - Is this a scam?

td123 — Wed, 27 Sep 2023 07:38:57 GMT

@Ady-TalkTalk Thanks for the info.

Re: Refresh Activation - Is this a scam?

Ady-TalkTalk — Wed, 27 Sep 2023 09:45:42 GMT

You're welcome.

Ady

Re: Refresh Activation - Is this a scam?

cranhpc1 — Thu, 26 Oct 2023 11:53:48 GMT

I am ashamed to admit that I was caught by this phishing scam, despite being a retired IT professional with 40 years experience.

The sender was purported to be obscured for customer security and like other victims because of the connection to the genuine TT email upgrade announcement, I clicked on it to find out more, even though I only make limited use of my TalkTalk email which was the one set as the account master:

The payload was two links to obscured for customer safety

XXXXX removed details for security reasons.

Its definitely not related to Hilton Hotels though they do have one near Hollywood. Any attempt to connect to the webserver at 93.109.85.20 is met with a 404. So far only a couple of phishing emails noted on my original account which may or may not be connected.

For my part I have changed passwords to random ones and assigned a different email to be for My Account login. I would like to delete the affected mailbox altogether but currently TalkTalk have this disabled because of work in progress which was meant to be done by September - any idea when this feature might return?

Re: Refresh Activation - Is this a scam?

Gliwmaeden2 — Thu, 26 Oct 2023 11:46:38 GMT

@cranhpc1, not helpful to post that link in full unless you wish other customers to share the same misfortune.