Phishing Scam Targets Hotmail/Live E-mail Users

Security researchers have warned users of Hotmail/Live, the free e-mail service, of a fresh scam e-mail posing as a message from the service's Customer Care.

The e-mail, designed to phish information, claims that it's a message from Hotmail/Live Customer Care to all service users regarding their accounts' security. The message then cites incidences of congestions the Hotmail/Live is experiencing because of unauthorized account registrations. Consequently, Hotmail/Live is closing some accounts and the account of the message's recipient is one of them.

The e-mail further states that it is noticed by Hotmail/Live that the account of the recipient has incurred a violation of Hotmail/Live Terms & Conditions, but if that's not true, then the recipient should reply with information asked in the e-mail.

For that, he should fill in the personal details for logging in by hitting the reply option. Failing to do so will mean suspension of his account within 48-hours.

The information asked comprises user's user ID and password, birth date and the country.

To sound genuine, the e-mail tells the recipients that they can have their accounts perform normally by complying with the instructions. But it warns that if any user fails to provide his updated account details within 14 days of getting the e-mail, he will have his account permanently deleted.

The security researchers state that there is an interesting thing about the spoofed e-mail. It doesn't get caught in the anti-spam filter of Windows Live Hotmail. The researchers believe the reason as the absence of a doubtful file attachment or an implanted web-link. Besides, the sender's address in the scam e-mail appears real.

Additionally, the researchers mention the signs that a vigilant Hotmail/Live e-mail user can recognize to help check the message's veracity. First, Microsoft never requests to send passwords through e-mail. Actually, no authorized entity will ever request for personal or confidential details via this mode as it isn't a sufficiently secured way.

Moreover, legitimate entities don't utilize threats for getting confirmed login or e-mail account information from users.

Related article: Phishing With A Redirector Code

» SPAMfighter News - 3/5/2010