Amazon hacked?

[Numpty]

I cannot find anything online in a Google search about this; perhaps your wiser heads will know more.

My wife got an email from Amazon yesterday saying she needs to validate her account details because of a recent order that is yet to be delivered.

How will VAT increase affect me?
The UK Standard VAT Rate will revert from 15% to 17.5% on Friday, January 1, 2010. Below you will find information about how the VAT-rate increase will affect you.

What do I need to do at this time?
We maintain physical, electronic and procedural safeguards in connection with the collection, storage and disclosure of personally identifiable customer information. In order to maintain the integrity of our system, we are requesting an update of your current account information. We hope you understand that this is a valuable security precaution designed to protect our customers.

The information you enter will be transferred to our Accounts Department for the purposes of processing by Amazon.co.uk. By submitting your information, you consent to this transfer.

My paranoid wife asked me to have a look. All seems genuine. The text has come from the Amazon.co.uk FAQ page. She has an order that was palced a few days ago that has not yet arrived. But...

The "Please verify your e-mail address to continue." link points at a script on voudini.com and amongst the headers is:

Return-path: <ghscom@host.globalherbalsupplies.com>

So it is a scam, a very convincing scam.

BUT

• This is the only email address we use for Amazon and it is used on Amazon.co.uk.
• Between us we own eight domains and any email, regardless of the bit before the @ is delivered to us.
• This is the only such email we have had.
• My wife has an outstanding order that will overlap the 1st Jan 2010 VAT change.

How did the scammer know the email address to use unless Amazon has been hacked, or a member of staff is responsible?

(Yes, I have reported it to Amazon.)

[SueEllen]

Spam emails work on coincident and targeting a large quantity of people.

For example if you know that there are 5 million current accounts in the UK with a certain bank that has online banking and you send out 16 million fraudulent emails to email addresses that you think that are UK residents about their one bank account, then statistically you will get:
1. people who bank with that bank AND
2. people who bank with that bank who only have one current account with the bank AND
3. people that bank with that bank who use the email address for their online banking who you targeted.

And of the thousand you get right a few of them will answer the email.

[jmo21]

agreed, spam is about the numbers.

What are the odds of a UK email address being used as an account on Amazon, and having placed an order around Xmas??

I have no idea, but that seems to be what they are trying to hit.

[Clippy]

^WTS

(Slim possibility that your WiFi, assuming you have and were using it at the time, was hacked).

[dmini]

Someone has been hacked recently. We got phone call from card supplier yesterday saying our card details "could have been compromised", and they were replacing all cards etc. Not hit news yet so don't know who, and they weren't telling.

[ee61re]

Someone has been hacked recently. We got phone call from card supplier yesterday saying our card details "could have been compromised", and they were replacing all cards etc. Not hit news yet so don't know who, and they weren't telling.

I assume they didn't ask you to 'confirm' any details?

(i.e - the call itself could have been a scam)

[SueEllen]

Someone has been hacked recently. We got phone call from card supplier yesterday saying our card details "could have been compromised", and they were replacing all cards etc. Not hit news yet so don't know who, and they weren't telling.

Happens all the time.

Also the post can be compromised, which is not always the post office/postman's fault.

[original PM]

on this note I got one from HMRC saying they owed me some tax - clicked the link and they wanted all my credit card details - including passwords so they could pay me back.

needless to say that went in the bin but it did seem to come from services@hmrc.gov.uk

weird.

[Numpty]

on this note I got one from HMRC saying they owed me some tax - clicked the link and they wanted all my credit card details - including passwords so they could pay me back.

That is a rubbish one:

Return-path: <no_reply@hmrc.gov.uk>
Envelope-to: numpty@my-personal-domain.co.uk
From: "no-reply@hmrc.gov.uk" <no_reply@hmrc.gov.uk>
Subject: Notice of your last annual calculation
To: "numpty" <numpty@my-personal-domain.co.uk>

After the last annual calculations of your fiscal activity we have determined that you
are suitable to receive a tax refund of 324,66 GBP.
Please submit the tax refund request and allow us 5-7 business days in order to process it

Note: A refund can be delayed for a variety of reasons.
For example submitting invalid records of applying after the deadline.

To acces the form for your tax refund, Click here

Best Regards,
HM Revenue & Customs UK

The 'Click here' points at:

http://www.hmrc.uk.com/refund_form/viewform.jsp.htm

I don't see how anyone call fall for that.

[original PM]

plenty of numpty would -- to promise of free money....