Apparently, the Scammers Have Stopped Writing Emails
I've written quite a bit lately about scam emails, suspicious recruiters, mystery attachments, and people desperately trying to convince me to click something.
Apparently, we've now reached the minimalist phase of scamming.
Why bother writing an elaborate fake invoice when you can simply send me an attachment and hope I do the rest?
Over the past few days, I received two more emails that follow essentially the same strategy: almost no information, a mystery attachment, and curiosity as the bait.
🚩 Scam Email #1: Thank You for the Order!
The first one came from someone identifying himself as Philip Smith, using a Gmail address.
The subject:
“Re: Thank you for the order 8WXJBZYM91JW858X2A”
Oh!
Thank you for my order!
There's just one tiny problem.
What order?
There's no company name.
No product.
No price.
No shipping information.
No recognizable merchant.
The body of the email contains essentially nothing except the same mysterious string:
8WXJBZYM91JW858X2A
And then there's an attachment.
A 244.4 KB file with a filename beginning with a date and my name.
That's a nice touch.
Putting someone's name in a filename can make the attachment feel personalized and legitimate.
But I'm supposed to believe I placed an order somewhere, received no explanation of what I purchased, and now need to open an unexplained attachment to discover what happened?
No thanks.
🚩 Scam Email #2: They Didn't Even Bother With a Subject
Then another masterpiece arrived.
Sender:
Anushka Chatarjee
Another Gmail account.
Subject:
<no subject>
The message was sent using BCC, suggesting I may simply be one of multiple recipients who received the same message.
And what's in the email?
Nothing useful.
But, naturally, there's a 390.8 KB Microsoft Word attachment.
So now the pitch has been reduced to:
Hi.
Actually, they didn't even say hi.
It's basically:
Here's a Word document. Open it.
That's the entire sales presentation.
The Attachment IS the Email
This is what people need to understand about messages like these.
The lack of information isn't necessarily a failure.
Curiosity can be the social-engineering technique.
The first email wants me wondering:
Did I accidentally order something?
Was my credit card compromised?
How much did they charge me?
What did I supposedly buy?
And where should I look for the answer?
Inside the attachment.
The second email is even more direct.
There's no story at all. Just a mysterious Word document.
The scammer doesn't necessarily need me to believe anything yet.
They just need me to open the file.
Why I Don't Open Them
I don't know what's inside either attachment because I didn't open them.
That's important.
I'm not going to claim these particular files contain malware, malicious links or credential-stealing software when I haven't analyzed them.
I also don't need to.
An unexpected attachment from an unknown Gmail account with no legitimate explanation for why I'm receiving it has already failed my trust test.
The safest question isn't:
“I wonder what's inside?”
It's:
“Why would I open this?”
And in both cases, I can't come up with a good answer.
The Fake Order Trick Is Particularly Clever
The fake-order approach adds another psychological ingredient:
Fear.
Imagine someone receives the first email and thinks:
I didn't order anything!
That's exactly when rational thinking can get replaced by urgency.
They want to find out whether someone used their credit card.
They want to know how much money was charged.
They want to cancel the transaction.
So they open the attachment.
That's why, if you receive a suspicious purchase confirmation, don't use the mystery attachment to investigate it.
Check your credit card or bank account independently.
Log into Amazon, Walmart, PayPal or whatever company supposedly processed the purchase by going directly to the service yourself—not through links or attachments supplied in the suspicious message.
If there's no transaction, there's nothing to cancel.
From “Pharmacy Office” to This
Just days ago, I received another email with the subject “Pharmacy Office.”
That one also contained mystery attachments with practically no explanation.
Now I've received a mysterious order confirmation and a completely blank email carrying a Word document.
There seems to be a theme developing:
The scammers want me to supply the curiosity.
Sorry.
I'm fresh out.
My New Attachment Policy Is Pretty Simple
Unknown sender?
Unexpected attachment?
No explanation?
Generic Gmail account?
Fake urgency?
Mystery purchase?
I'm not opening it.
If someone legitimately needs me to review a document, they can identify themselves, explain what they're sending, and give me a reason to expect it.
Until then, your mysterious 390.8 KB Word document can remain a mystery forever.
Sometimes the safest click is the one you never make.
Follow along at NielFlamm.com/blog for more scams, suspicious emails, questionable recruiters and the increasingly creative ways strangers on the internet try to get me to click things.