Thursday, September 30. 2004
Citibank Trains Phishing Victims
A friend of mine got the attached email. Very suspicious, HTML email with links embedded talking about Identity theft.Hmmm...Looking at the links, they link not to citibank.com or citicards.com but to a CGI program at citicards.chtah.com. Well, cheetahmail is a bulk emailer, but this looks very suspicious.
Clicking on the links redirects through chtah.com and ends up at citibank.com. No popups, no asking for information. But clearly, the CGI program was tracking which emails were responding.
Well, after talking to a very apologetic security analyst at Citibank and emails with a CheetahMail rep, it turns out that Citibank is helping it's users lower their guard against Phishing schemes by sending unsolicited emails with HTTP links talking about Identity theft.
This makes JaBbA's head hurt.
Trackbacks
Trackback specific URI for this entry
No Trackbacks
Comments
Display comments as
(Linear | Threaded)
I got a different email today from the same address... can you explain again what you found out?
Mine included these links:
http://citicards.chtah.com/a/tBDOaOfAPUQV6AY738-AO16W3qo/enroll
http://citicards.chtah.com/a/tBDOaOfAPUQV6AY738-AO16W3qo/click
Which I thought were "phishy" because they didn't go to citibank, citicards, citicorp, etc....
Mine included these links:
http://citicards.chtah.com/a/tBDOaOfAPUQV6AY738-AO16W3qo/enroll
http://citicards.chtah.com/a/tBDOaOfAPUQV6AY738-AO16W3qo/click
Which I thought were "phishy" because they didn't go to citibank, citicards, citicorp, etc....
chtah is a outsourcing agency used by Citibank to send and track email campaigns.
(The company is called CheetahMail)
It's just stupid to be using HTML links that connect to a domain not owned by the bank. It trains the users to NOT be suspicious.
(The company is called CheetahMail)
It's just stupid to be using HTML links that connect to a domain not owned by the bank. It trains the users to NOT be suspicious.