Phishing scam

[Durian1]

I received an email from TalkTalk this week advising about the new dashboard layout and taking more control of my account. I clicked on my saved shortcut in safari to sign into my account but got an error message. So I tried the link on the mail and it took through ok and all the data looked genuine. However when I was navigating it advised there was a technical error and I signed out. After that I struggled to sign in being advised it was a technical error. However I managed to sign in with Google Chrome.

When I tried signing in from my iPhone on safari I got a warning on Microsoft Defender that it had blocked a phishing link cdn.polyfill.io. I tried logging in on Google Chrome on my iPhone and got the same warning. The account appeared OK. I called TalkTalk security and they said change your password which I did but its made no difference. They couldn't find any problems and denied the link was coming from them. Sometimes if I sign in on my laptop I have a message saying due to technical problems I can't sign in but yet I can see my account page behind this. I have scanned my MacBook for malware and nothing was found. iPhones I am told should be OK and MS defender is blocking the link. Does anyone else have any ideas or similar issues?

[siphosethu-TT]

There's not much we can do in our end, but I'll escalate to see if that's possible. Thanks

[Durian1]

Hi siphosethu-TT

It turned out not to be a phishing scam as explained in all my other posts. Your technical on line support confirmed the email came from TT. Also I have seen the same emails to other users about your new dash board layout. 
It seems to me that your website is issuing a legacy link to cdn.polyfill.io which other posts seem also think is possible. Please can someone check the website and do a thorough trawl to remove the link if there. Please advise

[siphosethu-TT]

Hi there @Durian1, if you get any scam email, please use the link below advising you how you go about handling phishing emails. Thanks

Phishing emails - everything you need to know

[Durian1]

apologies typo on your name nambuso-TT on last post 😬

[Durian1]

Hi ambush-TT

Yes it was from TT regarding the new dashboard layout and taking more control yourself of your account. I spoke to someone in the customer support and they confirmed they sent the email. I also know someone else who received the same email. Both emails were personalised using our respective first names which I believe is a good flag from the advice TT publish about potential phishing emails. Ie suspicious emails are usually impersonal. 

[nambuso-TT]

Hi there @Durian1 I am very sorry to hear this. Please confirm if the email you received was from TalkTalk?

[Durian1]

Hi Nambuso-TT

Do you know if TT will be investigating this cdn.polyfill.io issue? It’s been very stressfull investigating only to find the likely issue could be with TT. If so then poor housekeeping on TT’s behalf. 
please advise 

[Divsec]

Hi @Durian1 starting to sound like a bit of TT not keeping their settings right up to date.

Your checks have been very thorough and for what it's worth I would feel reassured and secure.

[Durian1]

TalkTalk confirmed they sent me the email and there was nothing unusual about it. It addressed me with my name. I know other users who have had the same email so its genuine. I have scanned my MacBook with the TalkTalk Safe software on line and no reports of anything untoward

[Durian1]

I was wary of the email at first which is why I went straight to the TalkTalk web site to sign in

[Durian1]

TalkTalk confirmed they sent me the email and there was nothing unusual about it. It addressed me with my name. I know other users who have had the same email so its genuine. I have scanned my MacBook with the TalkTalk Safe software on line and no reports of anything untoward

[Durian1]

Yes my apps on my iPhone are up to date and hat's where I get the MS Defender notification

[fr8ys]

Also if you hover over the link it will probably show as a non TalkTalk address. If that's so just delete the mail.

TalkTalk have requested that spam mail be reported to them.
How to do this can be found here
https://community.talktalk.co.uk/t5/Articles/Phishing-emails-amp-everything-you-need-to-know/ta-p/30....
Thank you.

[Divsec]

Hi @Durian1 your post has been escalated.

Are your safari / apple apps up to date? The issue points to malware which was neutralised last year.

[nambuso-TT]

Thanks for advising @fr8ys

[fr8ys]

You should be very wary of emails purporting to be from TalkTalk that contain links. 

If in doubt, don't use them but sign in from your own trusted bookmarks.

Changing your passwords are essential and if you use the same combination, i.e email address and password to sign in in any other sites, change those passwords too.

It sounds like you are using a pc too. If so rye a full virus scan of that and a malware scan is recommended. I use the free version of malwarebytes.