There has been an increase in fake unau­tho­rized emails from crim­i­nals pos­ing as cor­po­ra­tions claim­ing to pro­tect theft iden­tity. Often these emails look legit­i­mate as they usu­ally include the com­pany let­ter­head and a mes­sage warn­ing you of impend­ing doom on your iden­tity. The ironic aspect of these emails is that the mes­sage, warn­ing you of iden­tity theft, is a bla­tant attempt at retriev­ing your per­sonal information.

For expe­ri­enced users and prop­erly con­fig­ured email servers, these mes­sages are fil­tered and imme­di­ately deleted. For the inex­pe­ri­enced, how­ever, it can lead to a dan­ger­ous sit­u­a­tion where your iden­tity and account infor­ma­tion is lit­er­ally handed over to a crim­i­nal. How do they accom­plish this? It’s sim­ple, they cre­ate a form using the spe­cific com­pany let­ter­head (CitiBank, Amer­i­can Express, Wash­ing­ton Mutual, etc.) ask­ing for your account infor­ma­tion. This usu­ally means your name and address and more impor­tantly your user­name and pass­word, which gives the crim­i­nal easy access to your bank­ing or credit account.

As I men­tioned, the tar­get is the inex­pe­ri­enced user, who in an attempt to avoid “account ter­mi­na­tion or sus­pen­sion” fork over their infor­ma­tion think­ing they are doing the right thing. Recently, I received an email from a per­son claim­ing to be in charge of Iden­tity Theft Solu­tions from CitiBank.

Here is the email in its full context:

CitiBank fake email example

It was easy to iden­tity the email as fake using the fol­low­ing visual indicators:

The sender email was from CITIBANK [identdep_​op7​2​1​6​1​7​2​9​2​9​@​citibank.​com], which apon first glance looks legit­i­mate. How­ever, one must real­ize that any email address can be eas­ily spoofed using a vari­ety of meth­ods includ­ing mask­ing the email address. Gen­er­ally, spam­mers spoof email addresses to pre­vent peo­ple from find­ing out who they really are. This also applies to crim­i­nals on the look­out for account infor­ma­tion who would rather not be caught by the law.

In this case, if the email were legit­i­mate, CitiBank would not state “Do not reply to this email”. It’s a good habit, if you’re sus­pi­cious, to go ahead and reply to the orig­i­nal sender about the legit­i­macy of the email and be sure to check the mes­sage header. In Out­look, Right-click the email and select Options. A “Mes­sage Options” win­dow will popup show­ing you the detailed mes­sage header. It’s impor­tant to take a look at the Received: infor­ma­tion, as shown below (it indi­cates the orig­i­nal sender loca­tion and IP address):

CitiBank fake email header

Another red flag for this email is that the con­tent itself is rep­re­sented by one graphic; in this case the Citibank logo and mes­sage text beneath the logo. There is absolutely no text in the email itself, every­thing is instead rep­re­sented by the image. If this was a legit­i­mate email from Citibank, it would include a let­ter­head and actual text in the mes­sage body. Unless it’s a promo from Citibank adver­tis­ing some­thing like cheap account fees, then dis­card the mes­sage and do not reply under any circumstances.