Symantec analysts have intercepted a 419 or advance fee fraud e-mail with a new twist – the fraudsters are utilising a “Send this page to a friend” service provided by the well-known sports TV channel ESPN’s Soccernet website to deliver their scam.
According to Symantec’s Dan Bleaken, this is a particularly clever “improvement” on the 419 scams that most e-mail users encounter at one time or another.
“The basic premise of a 419 scam is that the recipients are entitled to, or have won a large sum of money. In order to claim the money, they need to contact someone, usually via a webmail address, sometimes by calling a phone number, or by e-mailing personal details to a webmail address.
“If drawn in the victims are generally asked repeatedly for advance fees, for example an ‘admin fee’, ‘release fee’, or ‘international transfer fee’ before the money can be transferred into their accounts.”
Traditionally, according to Bleaken, the vast majority of 419 scams are sent from webmail accounts such as Hotmail, Gmail and Yahoo. This adds an appearance of legitimacy to the mail, makes the e-mail harder to block and helps hide the identity of the scammers.
“What makes this scam different is that it doesn’t arrive via webmail, it comes from ESPN Soccernet, a perfectly legitimate soccer news website. At the bottom of the mail is a link to an ESPN Soccernet story (see screenshot below).
The scammers have used a ‘Send this page to a friend’ service provided on the ESPN Soccernet site.
“The ‘Send this page to a friend’ service just picks up whatever is entered in the ‘Your E-mail’ box, validates it, confirms it as a valid e-mail address, and puts it in the body of the message sent. An almost foolproof method of delivering what is nothing more than an enormous, rambling, 419 scam!”
In order to protect themselves from such scams, Bleaken recommends that e-mail users make use of advanced 419 scam detection solutions. “These solutions not only detect the suspicious phrases and structures of 419s, but actively hunt for new scams and provide automatic updates,” he says.
For more information on the actual workings of this particular 419 scam surf to 419 scam.