Dayton, OH – October 23, 2008 – Your Better Business Bureau is alerting consumers and businesses about a phishing scheme that uses both e-mail messages and blog posts directing recipients and viewers to register software with your BBB. Your BBB wants the public to know such messages and posts aren't coming from any element of the BBB System and this attack has not affected BBB computer systems or networks nor has any data been comprised.
Reports to your BBB indicate businesses began receiving bogus messages earlier this week, requiring them to “register new software and update contact information” with your BBB, and provided a link for the process. In investigating the attack, your BBB also discovered phony “notices” and postings on various blogs being used as additional tactic to reach victims.
“The messages and posts are most likely part of a large-scale phishing scam leveraging the trusted nature of the BBB name to entice recipients and bloggers to open messages and access attachments or links,” said John North, BBB President and CEO. “Anyone receiving an e-mail or viewing a blog requiring the registration of software with your BBB should not click on any links or in any way respond to the message, because doing so may allow harmful viruses or spyware to enter the recipient’s computer or network.”
Following is a copy of an actual e-mail associated with this phishing scheme:
---------- Original Message ----------------------------------
From: "Better Business Bureaus Account Service" <provisor670@bbb.org>
Date: Wed, 22 Oct 2008 21:04:22 +0000
Attention Better Business Bureaus Consumers!
We've enhanced web surfing process with new security measures to keep your online data and personal information safer.
All registered and new BBB consumers must register new software and update contact information until October 24, 2008.
Please read the following information carefully:
Register your BBB company certificate here>>>Link
As always, we appreciate your business. And thank you for working with us.
Sincerely, Sherry Hopper.
2008 Council of Better Business Bureaus
Your BBB has determined there are a number of addresses and subject lines being used in to perpetrate the e-mail element of the attack. Following is a representative sample of actual address and subject lines used in this attack.
· Address: “Better Business Bureaus Service Center " provisor399@bbb.org
· Subject Line: Council of Better Business Bureaus - We restrict access to nonpublic personal information about you
· Address: "Better Business Bureaus Update" provisor633@bbb.org
· Subject Line: Better Business Bureaus, Attention: Protecting your personal information
· Address: Better Business Bureaus Support Center provisor062@bbb.org
· Subject Line: Better Business Bureaus, Attention: Shred unwanted documents that contain personal information.
The phishing scheme is also appearing on multiple blog sites. Following is a representative example of the type message your BBB research and investigation has discovered on a number of blog sites.
“We've enhanced web surfing process with new security measures to keep your online data and personal information safer.
All registered and new BBB consumers must register new software and update contact information until October 24, 2008.”
Please read the following information carefully>>>Link
Your BBB is advising consumers and businesses to take the following precautions and actions to steer clear of this phishing attack and to protect their computer systems and networks.
- Anyone receiving an e-mail similar to those described should not open the message, not click on any links or respond to the message – the message is not from any entity affiliated with your BBB. Opening or viewing a preview of the e-mail or clicking on the link within the e-mail could enable a discreet download of a virus or spyware.
- Report receipt of any such messages. Your BBB is working with the U.S. Secret Service's Electronic Crimes Task Force (ECTF) to address phishing issues using the BBB name. Your BBB has established an e-mail address - phishing@council.bbb.org – people can use to forward the message to, thereby reporting the incident to your BBB and the ECTF.
- The public can view updates and the latest information on the phishing attack on your BBB Web site at the Security and Alerts Web page at http://www.bbb.org/securityalerts.
About Your BBB Serving Dayton and the Miami Valley
Your BBB is an unbiased nonprofit organization that sets and upholds high standards for fair and honest business behavior. Businesses earning BBB Accreditation contractually agree and adhere to the organization’s high standards of ethical business behavior. Your BBB provides objective advice, free business BBB Reliability ReportsTM and charity BBB Wise Giving ReportsTM and educational information on topics affecting marketplace trust. To further promote trust, your BBB also offers complaint and dispute resolution support for consumers and businesses when there is difference in viewpoints. The first BBB was founded in 1912. Today, 126 BBBs serve communities across the U.S. and Canada, evaluating and monitoring nearly 4 million local and national businesses and charities. Your BBB serving Dayton and the Miami Valley serves Montgomery, Greene, Clark, Darke, Miami, Preble, Shelby and northern Warren counties. Please visit www.bbb.org for more information about your BBB.