Overpayment Refund

[#1]

---

@shutter wrote:

Just thought I would pass the message on to PN via the forum, and for the benefit of others, who may well have been "taken in" by it.

I really do appreciate it.

[#2]

That's ok.  Spam emails are annoying and frankly hard to avoid, but there are ways to cut them back.

For anyone who isn't aware, the email or domain (or both) of spammers can be entered in Plusnet's

White/Blacklist Filtering:

Paste it into the Blocked section, obviously ... and it should prevent their emails even appearing in your inbox in future

[#3]

It does look as if I have been pwned but it was in 2017 and I became aware of it so changed my passwords. 

[#4]

@GDD1000, that is always good practice, though your email address will still be on the lists as at least a once active email address, so from time to time will still be targeted.

[#5]

This has reared its head again.  Two fake messages yesterday and two more today with a fake PN webpage inviting you to login to claimn the £185.21 overpayment

one comes from Plusnet [Support] [030CA9] <s.d.lewis at live.co.uk> with a link to a page on 

crm.newcitydhancapital.com the registrar for the domain is namecheap.com and the r tegistrant purports to be in Reykjavik

Be warned and don't click on any links

Moderator's note by Mike (Mav): Email and web addresses edited to make them unclickable.

[#6]

Sadly I responded to this dreadful scam...worried. What do I do now?

[#7]

@Dancer2 I don't know what details that 'Claim Refund' link asked for, but if it was your bank account details, immediately contact your banks fraud Team and explain the situation - they will help and advise you.

[#8]

@merlin1

I would not click on links as suggested, but you have just posted a live scammer e-mail address and one of the live links we shouldn't have clicked on?

[#9]

@Alex 

First the email supposedly came from PlusNet Support but this was a spoof from the email address quoted, the second email also claimed to be from PlusNet Support but the actual email address was different.  These email addresses will no doubt be throw away rather than belonging to a real person.  They were not links to a bad website.  I quoted one to illustrate that the PN support was spoofed.

Secondly I did note quote a live link to the payload but the domain (or more accurately subdomain) used to host the payload.  The full URL has rather more text after the domain name eg /***/****/*** etc.   If I had quoted that and you followed the link, yes you woul get to the payload, but I did not do that.

The implied question is why would PlusNet be using a domain registered to a site in Iceland rather than its own domain. Clearly it would not.

Thank you for raising this as it has prompted mne to give a fuller explanation.

[#10]

The best advice is to contact your bank.  You should also advise Action Fraud.  Be aware that the scammers may use what you've given them to contact you so be on your guard.

[#11]

@Dancer2 

Hopefully you have advised your bank by now.

But, a word of warning, as above, on the information you provided via the link scammers might contact you saying that they are your bank to say you account has been compromised, saying you need to transfer your money to a 'safe account'. A real bank would not instruct you to do this and you should hang up call the immediately. Regardless how much they may insist they are your bank, a real bank fraud line would accept you being cautious.

Do not call any number someone give's you over the phone, check your banks website and use the contact us number found there.

[#12]

... and do not be sucked in by a call with a CLI belonging to your bank.  Ask for a case reference and say you will call them back.  Then place the call yourself, using a known number, having ensured that you have a dial tone first (if using a land line).

Fraudsters have been known to spoof the CLI of banks / credit card fraud departments and (when you say you will call back) hold the line open whilst you "blind dial" (typically) on a phone where you dial (enter) the number and only then connect to line ... so you might not be aware that there was no dial tone ... and (unknown to you) you are still talking to the scammers.

[#13]

This has all happened to me recently so please follow the advice you have been given.  It is absolutely likely to happen.