Refresh Activation - Is this a scam?

[td123]

Hi All, I recieved an e.mail today from a gary.mcglouglin@ tiscali.co.uk with the title "TalkTalk - Refresh Activation!" (Screenshot attached) within the e.mail is a button to Refresh Your Account and another link providing more info .

I know there is the big upgrade coming and this could well be legit with but as this e.mail has not come from the recognisable info.customer @talktalk.co.uk I wanted to check before clicking on any link/button. It looks like a TalkTalk communication - but we all know that doesn't mean it IS from TalkTalk and an announced upcoming mailbox upgrade could be an ideal opportunity for scammers to harvest lots of personal data.

Regards 

td123Legit ??

[cranhpc1]

Thanks for advice, Gondola. Given that I think that the payload link did not appear to work I think I shall wait and see, I do have an active paid for identity protection subscription provided by another organisation, in respect of the Capita data breach(es).

[Gondola]

If you wish to have email addresses deleted then contact the Data Protection Team.

[Gliwmaeden2]

@cranhpc1, not helpful to post that link in full unless you wish other customers to share the same misfortune. 

[cranhpc1]

I am ashamed to admit that I was caught by this phishing scam, despite being a retired IT professional with 40 years experience.

The sender was purported to be obscured for customer security and like other victims because of the connection to the genuine TT email upgrade announcement, I clicked on it to find out more, even though I only make limited use of my TalkTalk email which was the one set as the account master:

The payload was two links to obscured for customer safety

XXXXX removed details for security reasons. 

Its definitely not related to Hilton Hotels though they do have one near Hollywood. Any attempt to connect to the webserver at 93.109.85.20  is met with a 404. So far only a couple of phishing emails noted on my original account which may or may not be connected.

For my part I have changed passwords to random ones and assigned a different email to be for  My Account login. I would like to delete the affected mailbox altogether but currently TalkTalk  have this disabled because of work in progress which  was meant to be done by September - any idea when this feature might  return?

[Ady-TalkTalk]

You're welcome. 

Ady

[td123]

@Ady-TalkTalk Thanks for the info.

[Ady-TalkTalk]

If you want to verify the source of the email. Click on the 3 dots above the mail and click on view source. 

This will show you the genuine mail sender. Please send the mail header to me via private message. I should add that I'm already working with security and the email project to stop this. We only send mail from 1 address and its not a name at tiscali or talktalk.

Ady

[Geoff15]

Thanks @td123 - Yes I've updated my password, which was a bit of a faff.  It has to be reset through talktalk webmail rather than MyAccount, which would seem to be the obvious place for a reset. Once the p/w is updated in webmail it automatically updates My Account.

[td123]

@Ady-TalkTalk    -   Maybe, but please describe method so that I and other readers will have the info.

@Geoff15              -  Probably a good idea to change your passwords to be on the safe side.

[Geoff15]

I've fallen for this scam. The email came from <chazclark@tiscali.co.uk> and foolishly I clicked on the Refresh Your Account button. It came through recently with a legitimate TalkTalk email reminding me that my Fibre contract was coming to an end soon, so I guess my guard was down. I've forwarded the scam email to phishing@talktalk.co.uk and report@phishing.gov.uk

[Gliwmaeden2]

Strangely, @fr8ys, the original authentic Talktalk emails notifying us about the upgrade etc were not personalised.  They just began "Hi".

Very poor practice! But it means that your wife's one stands out as being different from both Talktalk's own and the scam that most recipients appear to have had.

For the scam to be so "on topic" and a plausible spoof, and all the "senders" names indicating that the scammer is aware of the range of Talktalk  / Tiscali etc that Talktalk covers, it's very worrying that this is not an amateur job.

[fr8ys]

@Ady-TalkTalk I know I should probably have started my own thread, but didn't want to put the screenshot on the open forum showing my Wife's details.

If they can now insert a person's name into a scam mail that is a worrying thought going forward as it is one of the safety things people look for on a scam e-mail.

I have sent it to you in a PM.

Steve

[Ady-TalkTalk]

Hi td123, that will be a spoofed email address. Do you know how you check the mail header to identify the real sending information?

Ady

[Gliwmaeden2]

A very worrying development, @fr8ys.

One does wonder if there's been what could be a catastrophic security lapse. I'll re-escalate this, as it's a new aspect. 

[fr8ys]

My wife has had one today.

Strangely, unlike the screenshots here that just say Hi, my wife's says Hi then her full name, not contracted and not the email address.

The full name is used only as the name on the email. It does not show within the email address 

Have the emails been hacked to be able to show the name?

The actual sender is austinanderton @ tiscali .co .uk

[Floydoid]

I've had phishing / scam stuff before from the alleged talktalk.net domain. If you're savvy and check the details of the originating email address that soon tells you if it is a scam or genuine. Hovering over any links helps too - if they look like nonsense, then they probably are

[Gliwmaeden2]

Yes, it would. 

I posted a topic for people to be alert to the issue but don't know how to turn it into a sticky notice.

Nothing showing in the Service Status Dashboard either, but I know staff are aware.

[Floydoid]

I got a similar mail this morning from the address keddod@talktalk.net.

[td123]

@Gliwmaeden2  So we were right to be wary.  Many thanks for the confirmation. Might it not be a good idea for TalkTalk to send out an e.mail to all subscribers warning that this scam is happening and not to engage?

@Pash02  Great minds think alike!

td123

[Pash02]

I was going to ask the same question

I have sent mine to report@phishing.gov.uk Scam?