How Spammers Target Hotmail Customers Using 'my name, my picture, and my signature'

Phishing scams are one of the simplest ways that spammers use to gain control of your account. The spammer sends an email that asks for your password, usually with a threat that your account is about to be closed. You reply, providing your password, and, Voila! Your account (and reputation) is hacked. Spammers do this […]

Phishing scams are one of the simplest ways that spammers use to gain control of your account. The spammer sends an email that asks for your password, usually with a threat that your account is about to be closed. You reply, providing your password, and, Voila! Your account (and reputation) is hacked. Spammers do this on all networks and all services - Hotmail, Gmail, Yahoo!, Facebook, AOL - spammers do not discriminate, and no service is immune.

Dick Craddock, Group Program Manager, Hotmail, in his latest blog post talks about the phishing scams that target Hotmail customers using his credentials. Craddock said that "No one from Hotmail or Microsoft will ever ask for your password. In fact, no legitimate service will ever ask for your password." If you ever get an email asking for any password to any service -- jst junk it, or, in Hotmail, mark it as a phishing scam using the "Mark As" menu.

"If you're wondering, Why can't Hotmail detect these scams? Craddock said that "We can detect these scams and do detect many of them. But it's just a numbers game, and spammers are capable of producing a huge volume of phishing scams, with enough variation in the text and images to fool our filters a small percentage of the time. In addition, it's important for us to keep the false positives low - meaning that we don't want to mistakenly identify a legitimate email sent from a good user as spam."

Craddock explains "I'm talking about the phishing scams that target Hotmail customers using my name, my picture, and even my signature":

How my picture got out there
Hotmail sends email to our customers fairly regularly to update people on various things.[…]About a year ago, we decided that we would make these messages more personal by including my name, my picture, and my signature. And, that decision has really come back to haunt me.

Almost immediately, spammers copied that email, including my picture, name and signature, and modified the content. "Phishing scammers know that they'll get better response rates by using my pictures and my signature to produce email messages that look legitimate. They even translate their scams into multiple languages to broaden their reach," Craddock stated. Here's an example:


Phishing messages can look very real and convincing, so even smart, tech-savvy people fall for them. Here's a conversation that took place on my public Facebook page:

Tactics scammers use to get people to provide their account info:

  • They copy Hotmail's marketing images. These phishing messages usually contain the latest image from Hotmail's own marketing campaigns.
  • They provide a bogus reason for needing your password:
    • "We are currently upgrading our data base and e-mail account center."
    • "We are deleting all unused accounts to create more space for new accounts."
    • "We encountered a problem with our database and a lot of records were lost, we are restoring our database to enable us serve you better."
    • "We are having too many congested email due to the anonymous registration of Hotmail Msn-Live Accounts in our database system."
  • They design a subject line to scare you:
    • Some variation of "Account Alert!!!", or "Account upgrade alert," or "Email account alert."
    • Some variation of "Account renewal process," or "Verify your account details."
    • Some variation of "Email Warning!!!", or "Verify your email now to avoid being closed!!!!!"
  • They send the email from a bad "From" address - which's often a dead giveaway. At a glance, it might look like you've gotten mail from the Hotmail Team. But if you look at the actual email address, it's almost always something fishy (phishy?). Typically, scammers just use the name of a Hotmail customer account.

[Source: Inside Windows Live]