Don’t be that guy! Falling for this one could be embarassing!

Posted by Annalivia Ford on August 15, 2011

I’ve been doing this job for a long time, and even so sometimes I get a scam mail that makes me hesitate for a moment. I got one of those this morning, addressed to an Operations catch-all address. The subject line was “Domain Notification: ADMINISTRATOR – UNICA ON DEMAND This is your Final Notice of Domain Listing – UNICA-MAIL.COM“

Hm. I work for a corporation, after all, and people do stuff with our corporate domains that I don’t know about, so I glanced at this and initially no alarms went off. Then I saw this part: “Domain Name: UNICA-MAIL.COM Search Engine Submission.” Wait, what? Why would a domain we use for internal stuff be submitted for search engine optimization? Suddenly this started looking a little more hinky, so I examined the mail in detail.

Things started leaping off the page at me, like “Payment by FAX only” and “Please do not include your credit card number on this form just fill the information above and fax it to us, once we receive your fax we will send you instructions on how to make a payment by credit card“. What legitimate SEO company does business this way? I examined the headers and it is coming from an obfuscated IP owned by web hosting company in Canada, and at the bottom there is a ymail.com dropbox to which you can send your unsubscribe requests – I’m certain they will honor your request promptly! (Not really.)

This is really a very sneaky scam. The whole email is carefully crafted, full of correct details about my company, and is quite professional looking. To clinch that, at the bottom is the piece de resistance: a “legal” disclaimer that is designed to intimidate the recipient into not making inquiries or complaints about the email: “The information in this letter contains confidential and/or legally privileged information from the notification processing department of the DN. This information is intended only for the use of the individual(s) named above. If you are not the intended recipient, you are hereby notified that disclosure, copying, distribution or the taking of any action in reliance on the contents for this letter is strictly prohibited.”

Of course, this is nonsense. There’s nothing privileged about a solicitation for services, even if the solicitation were actually genuine. There’s nothing in the email that is confidential. All the information contained in it is freely available to anyone with a search engine and the ability to use it.

So, to sum up. A company that claims to have its offices located in Torrance, California, is sending mail from a Canadian IP, using a Gmail account as the From address and a Ymail account as an “unsubscribe” tool. It is soliciting a substantial amount of money to submit my company’s internal domain name to a search engine (which one, I wonder?) to enable our customers to find us online, and they are demanding that I send them a fax, so that they can then turn around and send me instructions on how to make a credit card payment…and trying to scare me into doing nothing if I happen to notice there is something very fishy about this whole construction.

That being said, this isn’t one of those emails that can be subjected to the “if it looks too good to be true, it probably is” test. They’re not offering a bazillion dollars for free. They’re not offering to increase your…enjoyment…of your love life. They’re not offering cheap medicine to people who can’t afford their own. They’re offering what appears to be a legitimate service at a reasonable price. It looks professional, clean, and at first sniff, genuine: the perfect hook to send a harried office worker who doesn’t know how to read headers, doesn’t really know what the offer means, and hasn’t spent years dealing with scammers for a living.

BZZZT! FAIL! Dont be that guy! Explaining to your boss how it came to be that you handed over your corporate credit card number to a scammer that is very likely to not even be in the jurisdiction of the United States could be very embarrassing and expensive, not to mention career-limiting.

Look at any email that is asking you for money with a critical eye, even if it seems like it should be real. Ask yourself some questions. Ask someone who knows more than you some questions – I did! and take no action until you have done your due diligence. It could save you a lot, including your job.

Tags: Best Practices, Deliverability, Email Marketing