Latest phishing email contains personal data
Action Fraud says it has received thousands of calls about a new email scam that's sweeping the country.
It's of particular concern, they say, as the emails include detailed personal information such as full name, address and postcode. They are also - unusually - grammatical and correctly spelled.
The emails purport to be chasing up a debt to one of a number of companies, including Optex (Europe) Ltd, British Millerain Co Ltd and Greenoaks Ltd - all perfectly legitimate companies that have nothing to do with the scam.
They claim that there's an invoice outstanding, and ask for payment of several hundreds of pounds. The recipient is asked to click on a link to receive a printable version of the invoice.
In fact, however, it's a so-called malicious link, which will infect the user's computer with malware. The scammers have almost certainly bought a database of names and addresses that has been hacked from elsewhere.
In this case, the malware is Cryptolocker, which encrypts the files on the victim's computer and then demands a ransom to unlock them. The ransom - to be paid in untraceable Bitcoins - goes up over time if the victim doesn't pay.
Waxed cotton manufacturer British Millerain has told Radio 4's You and Yours programme that it's had more than 150 calls from people who have received one of the letters. But this is likely to be the tip of the iceberg.
And, says Action Fraud, "This spear phishing campaign could constantly evolve, so look out for company variations and remember that is easy for fraudsters to adapt information."
Another very similar scam is also making the rounds, claiming that there is a new service up and running to make it easier for people to pay their council tax bill online. Again, people are asked to click on a malicious link that downloads Cryptolocker to their PC.
However, this email isn't personalised like the others, and is typically badly written: "You can setup monthly payments as well as settle your council tax bill off," it reads.
Anybody receiving what they believe to be a fraudulent email is encouraged to report it to Action Fraud through this - perfectly legitimate - link.
