BBB Warning Against Fraudulent Phishing Scam

The Better Business Bureau is advising businesses and consumers from opening or responding to phony BBB emails from the address of IDTheft@bbb.org.

Individuals posing as the BBB have launched a phishing attack that has quickly evolved from their original “complaint-against-your-company” angle into the subject of “ID theft.” The BBB suspects that the scammers have changed the topic of their messages in an attempt to throw authorities and the BBB off of their trail.

The BBB urges companies and consumers alike to ignore all emails coming from  IDTheft@bbb.org. Although it is suspected that recent phishing attacks are targeting businesses exclusively, consumers could become victims as well.

An example of the fraudulent email is posted bellow. Note the fraudulent emails include an attachment. When accessed, the attachment activates a virus contained in an executable file. Aside from affecting the recipient’s computer, the virus is also enabled to access the network’s directory, thereby automatically forwarding the message and potentially spreading the virus to other systems.

The suspect email reads as follows:

Dear Mr /Mrs John Cobey,

This is an automated email that confirms the registration of your complaint case number: CX638402516 filed by your company on 7/29/2007 concerning Online Identity Theft.

While The Better Business Bureau Online does not resolve individual consumer problems, your complaint helps us investigate fraud, and can lead to law enforcement action.

ATTACHED you will find a copy of your complaint. Please print and keep this copy for your personal records.

We use secure socket layer (SSL) encryption to protect the transmission of the information you submit to us when you use our secure online forms.

The information you provided to us is stored securely.

The form you used to register this complaint is designed to improve public access to the Better Business Bureau of Consumer Protection Consumer Response Center, and is voluntary. Through this form, consumers may electronically register a complaint with the BBB. Under the Paperwork Reduction Act, as amended, an agency may not conduct or sponsor, and a person is not required to respond to, a collection of information unless it displays a currently valid OMB control number. That number is 327-783.

Our staff will keep you updated regarding the status of our investigation.

©2003 Council of Better Business Bureaus, Inc. All Rights Reserved.

(See attached file: Complaint_638402516.doc)”

 Anyone who has received this email or one similar from IDTheft@bbb.org should immediately disregard it, as it has no affiliation with the BBB. The BBB hopes this press release will promote awareness about the nature of the counterfeit messages.

The BBB continues to work with the authorities and review alternative options to stop these malicious attacks. In response to the phishing attacks, the BBB has launched a security alerts page. The page is available at BBB.org/email. This page contains specific information to help recipients of the email determine if their message is fraudulent. It also includes detailed instructions for forwarding the message without risking the sender’s computer.

The BBB recommends businesses and consumers that have been exposed to the phishing scam refer directly to this page.