Have you been told to verify your Hotmail account? Did you receive a message saying that Hotmail's email servers were congested, and so they were removing all unused accounts?
If so, I hope you responded to the email with a roll of the eyes and a quick stab of the delete button. Because if you didn't, you might have been at risk of having your login credentials stolen.
Thanks to Naked Security reader Rob, who forwarded us the following phishing email that he and others received, posing as communication from Hotmail:
Part of the email reads:
We are upgrading our database to serve you better. Due to the congestion in our E-mail servers there would be removal of all unused Hotmail Account. You will have to confirm if your E-mail account is still active by filling out your information below after clicking the reply button
The email then requests that you reply with your Hotmail username, password, date of birth and country. Of course, doing so puts vital information right into the hands of the cybercriminals.
It looks like the bad guys have had some problems in the past though, with victims handing over incorrect information (how typical!):
Ensure every detail requested above is provided correctly upon receipt of this notification to enable the upgrade. Incomplete details and wrong passwords forwarded will result in suspension or closure of your account for security reasons.
The fact is, of course, that the email isn't from Hotmail, and they would never ask you for your password. Although a simple phishing scam like this can be obvious to those of us who work in the field of computer security, there are plenty of less-savvy people out there who might be fooled into responding - and hand over the keys to their account.
Follow @gcluley
For years we have been telling people that cigarettes will kill them and yet they still smoke and claim they didn't know. This is EXACTLY what happens with these scams; no matter how many times you tell someone, they are still going to fork over their info and claim not to know.
Ok. Something like this happened to me yesterday, except I got locked out of my account as my password was not longer valid. Yes, I got to the page asking me to put in all my information including the last four digits of my credit card. I started filling it out, in my panic, but thankfully came to my senses and closed the page. But I still had to reset my password via the alternate e-mail address I’d given. Now I need to know if that was legit or do they now have my new password?
This is freaking me out!
Just in case they’re related, at about the same time I’ve been unable to access the online application pages for the two private schools my son is applying to. They are able to access them from their computers at the school, but I can’t for love or money. Now I can’t even download one of the school’s websites.
I’ll be calling Apple et al, but the applications were due yesterday so this is effing up my world.
Same thing has happened a couple times with a Yahoo email account I use. Seriously now people.
I know it wont work with me thanks to this article and that I have a good scam and spam and hoax sense on me thats key so I dont fall fowl of these scams
The email that I got also asked to provide details for an alternate email address & password...
wow. just by the grammar you know its a damn scam!!! Thats the first clue!!!
Of course you're right about the grammar. Alas, the moronic grammar that typically appears in these scams can only be recognized by a person who knows correct grammar in the first place. In my experience, that probably excludes most of the people who use the Internet, judging by the horrifying grammar in the vast majority of posts I read.
On that basis (and this is the truly pathetic part), it seems likely that what obviously appears as a scam to you and me easily gets in under most people's crap-grammar radar.
Thanks for your site and posts. You have quickly validated what I believed was happening. I just received the latest version from "m.bethkuehn@hotmail.com " with attachments blocked.
The illiterate text is : "We are having too many congested email due to the anonymous registration of Hotmail,Msn and Live Accounts on our database system. That is why we are asking you to confirm your email account and your information so that your account will still be working as normal and also be recorded on our database system. We need you to fill in the information below within 48hours and email will be sent to you from Windows Live for confirmation and also on how you are going to secure your account. "
They asked for all the info including password as previously mentioned here.