Tesco Christmas Voucher Phishing Scam

Outline
Email claims that Tesco Bank is giving out free Tesco Christmas shopping vouchers to recipients who click a link to validate their account details.



Brief Analysis
The email is not from Tesco. The "validate link" in the message opens a bogus website that asks users to supply their Tesco account login details along with their email account information. This information can be collected by scammers and used for bank fraud and identity theft. If you receive this email, do not click on any links or open any attachments that it contains.

Enter your email address to subscribe to the Hoax-Slayer Newsletter:

Last updated: November 22, 2012
First published: November 22, 2012
Article written by Brett M. Christensen
About Brett Christensen and Hoax-Slayer

Example


Detailed Analysis
This email, which purports to be from Tesco Bank, claims that recipients can qualify for a free Tesco Christmas shopping voucher by clicking a "validate" link and supplying their account details. According to the message, the voucher will be sent to them via email or text message after they have completed the validation process.

However, the email is not from Tesco and the promised vouchers are just the bait used to hook unwary recipients. Those who follow the link will be taken to a bogus website and asked to enter their username to login:



After entering their username and clicking the "Login" button, they will be taken to a second fake page that ask for bank access details as well as their phone number, email address and email password.



After supplying the requested information, and clicking "Next", victims will be automatically redirected to the genuine Tesco website.

Meanwhile, the criminals running this phishing campaign can collect all of the information submitted on the fake website and use it to hijack real Tesco online accounts. They can also use the stolen information to hijack email accounts and use them for further spam and scam campaigns. Of course, victims will never receive the promised shopping vouchers, which never existed in the first place. If you receive this email, do not click on any links or open any attachments that it contains.

It is always safest to login to all of your online accounts by entering the account web address into your browser's address bar rather than by clicking a link in an email.




References
Phishing Scams - Anti-Phishing Information
Friend Stranded in Foreign Country Scam Emails

---

Pages in this issue:

1. Jetstar 'Flight Itinerary' Malware Email
2. WhatsApp 'Logo Will Turn Red' Hoax
3. Christmas Cards for Recovering American Soldiers
4. Virgin Money 'Re-Confirm SiteKey' Phishing Scam
5. How to Survive a Heart Attack When Alone Hoax
6. Facebook Deleting Inactive Users Hoax
7. Completely Pointless and Misleading 'Facebook Privacy Notice'
8. Absurd Warning - 'LOL' stands for 'Lucifer Our Lord'
9. Bogus Prize Offers on Facebook - 'Like and Share To Win'
10. Tesco Christmas Voucher Phishing Scam
11. DEW Bottled Water Fatal Poisoning Hoax
12. ANZ 'Reward for Loyal Customers' Phishing Scam
13. Chase Paymentech 'Merchant Billing Statement' Malware Email
14. Undertaker - John Cena 'Bloodiest Fight Ever' Survey Scam
15. Padlock on Facebook Home Page Hacker Warning Hoax
16. Woolworths 'Customer Satisfaction Survey' Phishing Scam
17. Target 'Free Gift Voucher' Survey Scam
18. Another Pointless Facebook Warning - Hackers Posting Insulting Messages In Your Name
19. Fake Tsunami Warning 'News' Report Points to Malware
20. Reserve Bank Of India Phishing Scam
21. Better Business Bureau 'Complaint Received' Malware Emails