http://www.pmiexport.it/newsite/newbranch.html (Edited)

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Posted: Fri Jul 06, 2007 7:18 pm

Let me know when to destory. Twisted Evil

Not quite a Newb Joined: 14 Jul 2005 Posts: 41

Why do you think that is fake, Mayor?

Can you post the email?

Posted: Fri Jul 06, 2007 7:29 pm

Here is the link trying to get information:

http://www.pmiexport.it/newsite/profile.html

Also here is the email:

Return-Path: <[email protected]>
Received: from compute1.internal (compute1.internal [10.202.2.41])
by store31m.internal (Cyrus v2.3.8-fmsvn11630) with LMTPA;
Fri, 06 Jul 2007 09:08:32 -0400
X-Mail-from: [email protected]
Received: from lonmx1.Hymns-AM.local (scmsdsl.gotadsl.co.uk [84.12.138.198])
Fri, 6 Jul 2007 09:08:31 -0400 (EDT)
Received: from User ([213.8.29.235]) by lonmx1.Hymns-AM.local with Microsoft SMTPSVC(6.0.3790.1830);
Fri, 6 Jul 2007 14:08:24 +0100
Reply-To: <[email protected]>
From: "Northern Star Credit Union"<[email protected]>
Subject: Reactivate your Northern Star CU account immediately
Date: Fri, 6 Jul 2007 16:08:36 +0300
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-OriginalArrivalTime: 06 Jul 2007 13:08:24.0312 (UTC)
To: undisclosed-recipients:; Text view

> Dear Northern Star Credit Union Customer,

> The Northern Star Credit Union Online department temporary suspended your account.
You no longer have access to the account registered with this email address !
After three unsuccessful login attempts your account was temporary suspended until further investigations.

All cards (except the temporary cards) from this account are suspended.

You must reactivate your account at Northern Star CU immediately, or you won't be able to use your cards again.

> Once you have completed these steps, we will send you an email notifying that your account is available again.
The information you provide us is all non-sensitive and anonymous - No part of it is handed down to any third party.

> Sorry for any inconvenience this may cause and thank you for your patience

The IP resolves to Amsterdam on the email.

Baiting Guru Joined: 08 Jul 2004 Posts: 11857 Location: UK

Does look dodgy, it's on an Italian domain in Italian language:

www.pmiexport.it

Then on this page as posted by Da Mayor, it's all in English with a login box:

http://www.pmiexport.it/newsite/newbranch.html

Enter anything for username and password and you get taken to:

http://www.pmiexport.it/newsite/profile.html

Where it says:

Quote:

Welcome to the Northern Star Credit Union Internet Banking session

Attention: Your account has been suspended.

Please update your account immediately.

Not quite a Newb Joined: 14 Jul 2005 Posts: 41

Moved here.

It's a phishing email spoofing the legitimate Northern Star CU.

You can send them the email and they can take care of it, or post it on phishfighting.com

Phishing sites aren't sites we deal with in Fake Banks.

Posted: Fri Jul 06, 2007 7:34 pm

Got it. My newbieness may be showing, but how can I tell the difference between a phish site and a real fake bank? It is tough to know.

Not quite a Newb Joined: 14 Jul 2005 Posts: 41

No worries. It's a common mistake. Very Happy

SF has a very good post explaining the two here:
http://forum.419eater.com/forum/viewtopic.php?p=720553#720553

But basically, any unsolicited email telling you to log in and verify your account details is a phish; any email telling you to log in and verify that X amount of money is in a certain account is a fake site.

Posted: Fri Jul 06, 2007 7:40 pm

Phishing emails generally send you to a fake site pretending to be a real one where you (don't) log in with your real details, usually a one-off email.
Fake banks are normally sent via a lad email after several emails asking you to open an account, check your balance etc
edit: beaten to it again Sad

Master Baiter Joined: 03 Jul 2007 Posts: 158

Firefox has it listed as a Web Forgery - so anyone on FF wont get burnt.

I always get these kinds of phishing emails. Never do fall for it tho - something to do with not having accounts at the banks they are silly enough to send me one for Very Happy

http://www.pmiexport.it/newsite/newbranch.html (Edited)	View next topic View previous topic