Examples of Bad Email Messages (2023)

For a virus to infect your computer, you have to run it. Most often, thevirus attaches itself to an email message and usually (but not always) justviewing the email message is safe. However, that starts a cat and mouse gamewith the virus writer saying anything and everything he/she can think of totrick you into opening the attached file and thus running the virus andinfecting your computer.

Here are some examples of the ploys used to getyou to open an attached file. In these cases the messages came from someoneunknown to the recipient, but be aware that the FROM address of an email messageis very easily forged. Don't treat a message with less suspicion because it seemsto have come from someone you know. Also, see the note at the end of this topic;you may not be seeing the full file name of attached files.

In the message above that says "You are infected. Read the details!",the attached file is "old_photos.rtf.scr".You should not open .scr files either, just like .piffiles, Windows will try to execute them. The reason the file name has".rtf" in it is to fool people who know not to open files that areexecutable. An .RTF file is not executable. There is a very bad default inWindows Explorer that hides the file extension of files of known types. I thinkthis was done either to make Windows simpler for new users or to copy the Mac.It is a very bad way to go and all Windows users should change this option andforce Windows to always show you the full file name. If your copy of Windows isnot showing you full file names, you will see this attached fileas "old_phots.rtf"and feel safe opening it.

Still another trick takes advantage of the fact that many email messages arescanned by anti-virus programs before they reach your inbox. The virus inserts a forgedmessage at the bottom that looks like an anti-virus program scanned the email and gave it agood bill of health. For example:

As a point of comparison, below is a legitimate message from a server-sideanti-virus program that deleted a virus in an attachment:

For more examples of this and long list of cat and mouse tricks from theNetSky worm, see Virus Descriptions : NetSky.Pfrom F-Secure.

I don't have an example of this, but another common approach to trickyou into opening/running an attached file is for the email message to appear tocome from Microsoft. The message seems to be a warning that you you should update your security software.In reality, Microsoft never ever sends software via email. In fact, no legitimate organization will ever send you anexecutable file attached to an email message. Microsoft won't do it, Symantec won't do it, McAfee won't do it, Apple won't do it, Adobe won't do it, Macromedia won't do it, etc.etc. etc. These companies may send you a message announcing that a new patch ornew software is available, but they will never send the program or patch as an email attachment. The only way to be sure that a program or patchcomes from the company itself, is to go the company's web site and download itfrom there.

This article (Worm Steals CNN Headlines To Stay Timely, Fool UsersBy TechWeb News January 21, 2005) describes another new tactic to fool you. Thesubject line and body of the virus-laden email message vary frequently and arecopied from current news at CNN. Again, never click on a file attached to anemail message.

Report phishing emails to thePhishing Incident Reporting and Termination (PIRT) Squad
or to Phish Tank

Phishing refers to fraudulent email messages designed to trick you into providing personal information. This information is typically used to buy merchandise via credit cards and stick you with the bill.Be wary of any email message asking for your credit card number, Social Securitynumber, bank account number, phone number, mother's maiden name, etc.

The typical ruse is that there is a problem with your account and you have verify orre-enter this personal information. Tolearn more about the problem of phishing see www.antiphishing.org.

As part of the scam, the links in the email message do not take you where they appear to.Instead you are taken to a web site that looks real but exists on a computercontrolled by the bad guys.I have more details on the technical tricksused to fool you in my Links That Liepage.

Since a picture is worth a thousand words, here are pictures of some phishingemail messages:

Sample Phishing Emails

Classic ScamTOP

Ignore messages from someone claiming to be a representative of the Nigerian government, promising a multi-million dollar reward for your help in transferring a huge sum of money.This scam, known as the "419 Scam" or the "Nigerian scam", pre-dates the Internet. Victims are asked for their bank account and other personal information. Invariably a "problem" arises and the victimis pressured or threatened to provide a large sum of money to save the venture.

In another wrinkle, a person claiming to be from a third-world country, againwith custody of a large amount of money, offers to share the wealth with you if you willhelp them get it out of the country. The scammer needs your bank account information to deposit the money in your account. If you give it, youfind that money withdrawn from, rather than deposited to, your account.

Here are two examples:

Subject: NICE TO MEET YOU
From: "MR. KONAL OXFORD" <konal@katamail.com>
FROM: THE DESK OF MR.KONAL OXFORD.
CREDIT OFFICER, FOREIGN REMITTANCE DEPARTMENT, UNION BANK OF NIGERIA(U.B.N).

DEAR SIR,

FIRST, I MUST SOLICIT YOUR CONFIDENCE IN THIS TRANSACTION; THIS IS BY VIRTUE OF ITS NATURE AS BEING UTTERLY CONFIDENTIAL AND TOP SECRET. THOUGH I KNOW THAT A TRANSACTION OF THIS MAGNITUDE WILL MAKE ANY ONE APPREHENSIVE AND WORRIED,BUT I AM ASSURING YOU THAT ALL WILL BE WELL AT THE END OF THE DAY.

WE HAVE DECIDED TO CONTACT YOU DUE TO THE URGENCY OF THIS TRANSACTION, AS WE HAVE BEEN RELIABLY INFORMED OF YOUR DISCRETNESS AND ABILITY IN TRANSACTION OF THIS NATURE.

LET ME START BY INTRODUCING MYSELF PROPERLY TO YOU. I AM MR. KONAL OXFORD,CREDIT OFFICER WITH THE UNION BANK OF NIGERIA PLC,LAGOS. I CAME TO KNOW YOU IN MY PRIVATE SEARCH FOR A RELIABLE AND REPUTABLE PERSON TO HANDLE THIS CONFIDENTIAL TRANSACTION,WHICH INVOLVES THE TRANSFER OF HUGE SUM OF MONEY TO A FOREIGN ACCOUNT REQUIRING MAXIMUM CONFIDENCE.

THE PROPOSITION:

A FOREIGNER AN AMERICAN,LATE ENGR JOHN CREEK (SNR) AN OIL MERCHANT WITH T HE FEDERAL GOVERNMENT OF NIGERIA,UNTIL HIS DEATH IN KENYA AIR BUS (A310-300) FLIGHT KQ430,BANKED WITH US AT UNION BANK OF NIGERIA PLC LAGOS AND HAD A CLOSING BALANCE AS AT THE END OF JANUARY,2000 WORTH USD25, 000,000.00 (TWENTY FIVE MILLION UNITED STATE DOLLAR),THE BANK NOW EXPECTS A NEXT OF KIN AS BENEFICIARY.VALUABLE EFFORTS ARE BEING MADE BY THE UNION BANK OF NIGERIA TO GET IN TOUCH WITH ANY OF THE CREEK'S FAMILY OR RELATIVES BUT TO NO SUCCESS.

IT IS BECAUSE OF THE PERCEIVED POSSIBILITY OF NOT BEING ABLE TO LOCATE ANY OF LATE ENGR.JOHN CREEK(SNR)'S NEXT OF KIN (HE HAD NO WIFE OR CHILDREN THAT IS KNOWN TO US).THE MANAGEMENT UNDER THE INFLUENCE OF OUR CHAIRMAN AND MEMBERS OF THE BOARD OF DIRECTORS,THAT ARANGE HAS BEEN MADE FOR THE FUND TO BE DECLEARED "UNCLAINMED" AND SUBSEQUENTLY BE DONATED TO THE TRUST FUND FOR ARMS AND AMMUNITION TO FURTHER ENHANCE THE COURSE OF WAR IN AFRICA AND THE WORLD IN GENERAL.

IN ORDER TO AVERT THIS NEGATIVE DEVELOPMENT, SOME OF MY TRUSTED COLLEAGUES AND I NOW SEEK YOUR PERMISSION TO HAVE YOU STAND AS NEXT OF KIN TO LATE ENGR. JOHN CREEK(SNR) SO THAT THE FUND USD25 MILLION WILL BE RELEASED AND PAID INTO YOUR ACCOUNT AS THE BENEFICIARY'S NEXT OF KIN. ALL DOCUMENTS AND PROVES TO ENABLE YOU GET THIS FUND WILL BE CAREFULLY WORKED OUT.

WE HAVE SECURE FROM THE PROBATE AN ORDER OF MADAMUS TO LOCATE ANY OF DECEASED BENEFICIARIES,AND MORE SO WE ARE ASSURING YOU THAT THIS BUSINESS IS 100% RISK FREE INVOLVEMENT.YOUR SHARE STAYS WHILE THE REST BE FOR MYSELF AND MY COLLEAGUES FOR INVESTMENT PURPOSE.

ACCORDING TO AGGREMENT WITHIN BOTH PARTIES AS SOON AS WE RECIEVE AN ACKNOWLEDGEMENT OF RECEIPT OF THIS MESSAGE IN ACCEPTANCE OF OUR MUTUAL BUSINESS PROPOSAL,WE WOULD FURNISH YOU WITH THE NECCESSARY MODALITIES AND DISBURSEMENT RATIO TO SUITE BOTH PARTIES WITHOUT ANY CONFLICT.

IF THIS PROPOSAL IS ACCEPTABLE BY YOU DO NOT MAKE UNDUE ADVANTAGE OF THE TRUST WE HAVE BESTOWED IN YOU AND YOUR COMPANY,THEN KINDLY GET TO ME IMMEDIATELY VIA MY EMAIL: konal@ecplaza.net

PLEASE FURNISH ME WITH YOUR MOST CONFIDENTIAL TELEPHONE, FAX NUMBERS SO THAT I CAN USE THIS INFORMATION TO APPLY FOR THE RELEASE AND SUBSEQUENT TRANSFER OF THE FUND IN YOUR FAVOUR.

THANK YOU IN ADVANCE FOR YOUR ANTICIPATED CO-ORPORATION.
YOURS FAITHFULLY,
MR.KONAL OXFORD.

For more see www.secretservice.gov/alert419.shtmland The Nigerian Nightmare Who's sending you all those scam e-mails?by Brendan I. Koerner in Slate October 22, 2002.In addition 419eater.comhas stories from people who have engaged the scammers in conversations. Theycall it scambaiting - entering into a dialogue with scammers to waste their time and resources.

SPAMTOP

Bayesian SPAM filters have gotten so good that the bad guys have yet anothernew tactic, no words. An HTML based email message contains nothing but a link toa picture. The advertising message is wholly contained in the picture.

Why is there so much SPAM and Phishing? It's profitable and easy. Here is oneexample of the easy part. This is an actual email message that I received inApril 2004.