Debunking email hoaxes and exposing Internet scams since 2003!

Hoax-Slayer Logo Hoax-Slayer Logo

Home    About    New Articles    RSS Feed    Subscriptions    Contact
Bookmark and Share

Issue 162 - September, 2013 (2nd Edition) - Page 11

Land Registry Debit Notification Malware Emails

Issue 162 Start Menu

Previous Article            Next Article

Emails purporting to be from the UK's Land Registry claim that fees will be debited from the recipient's account in the coming days. The messages claim that users can access details about the fees to be debited by opening an attached file.

Vector illustration of single virus pc icon

© MyVector

Brief Analysis
The emails are not from the Land Registry. In fact, the attachment contains malware. The fee amounts specified in the emails may vary. If you receive one of these emails, do not open any attachments or click any links that it contains.

Bookmark and Share

Notification Date: 2/09/2013
Notification Number: 138418369

Mandate Number: 6626192


This is notification that Land Registry will debit 202.00 GBP from your nominated account on or as soon as possible before 10/09/2013.

Details of fees that we shall be collecting by direct debit for the applications charged are now available to view.

You can access these by opening attached report.

If you have an enquiry relating to your VDD account please contact Customer Support at or call on 0844 892 1111. For all enquiries, please quote your key number.

Thank you,

Land Registry

Land Registry is the definitive source of information for more than 23 million property titles in England and Wales. Since 1862 we have provided security and confidence in one of the most active property and mortgage markets in the world. We are working to support economic growth and data transparency as part of the Public Data Group. Find out more at

Detailed Analysis

Since early August 2013, debit notification emails purporting to be from the UK's Land Registry have been hitting inboxes. The emails claim that a fee of around 200 pounds will be debited from the recipient's nominated bank account by a specified date.  According to the messages, recipients can view details of the supposed fees by opening an attached file.

However, the emails are not from the Land Registry and the attachment does not contain fee details as claimed. Instead, the attachment contains a .zip file that in turn harbours a malicious .exe file.

If launched, this .exe file can install malware on the victim's computer. Typically, such malware can relay personal information stolen from the infected computer back to a remote server, download and install more malware and allow criminals to access and control the compromised computer.

The specified fee amounts in the emails may vary. Versions I have seen so far list the fee variously as 202, 203 and 286 pounds. Other incarnations may specify different amounts.   The date of the supposed debit transaction listed in the emails also varies as do details such as the "Notification Number" and "Mandate Number".

To make the claims seem more legitimate, the malware emails include legal terms, contact information and links that may be seen in genuine Land Registry messages.

The Land Registry has warned users about the bogus emails via the following notice on its online support community:

Have you received an unexpected email from us relating to "Notification of Direct Debit Fees"?

Please delete the email. It is a spoof mail and does not originate from Land Registry, although it is made to look like it has (Land Registry Direct Debit emails do not have a zipped attachment). 

If you have already opened any attachments or clicked on any links then please arrange for a virus scan to be run on your computer. 

Guidance on dealing with suspect email can be found on our website here:

The criminals responsible for this campaign hope that at least a few recipients will be panicked into opening the attached file in the mistaken belief that an unexpected fee is about to be debited from their accounts.

Scammers commonly use fake billing notification emails to distribute malware. Some companies or departments may provide information to customers via an attached file such as a .pdf. However, any such attachment that contains a .exe file, either directly or hidden in a .zip file, should be treated with extreme caution.

Bookmark and Share

Last updated: September 10, 2013
First published: September 10, 2013
By Brett M. Christensen
About Hoax-Slayer

Threat Outbreak Alert: Fake Land Registration Fee Collection Notification Email Messages on August 20, 2013
Have you received an unexpected email from us relating to 'Notification of Direct Debit Fees'?
Email security advice - Unsolicited / phishing emails
Bogus Telstra 'Email Bill' Carries Malware

Previous Article            Next Article

Issue 162 Start Menu

Pages in this issue:
  1. Unlucky Frog LADEE Rocket Launch Photograph
  2. Reshipping Fraud - Parcel Mule Scams
  3. 'Apple Account Frozen' Phishing Scam
  4. Warnings Claim Facebook Is Deleting Pet Profiles
  5. CASE NOW SOLVED - Message Asks For Help to Identify Man Killed By Train in Melbourne
  6. HM Revenue & Customs Refund of Overpayments Phishing Scam
  7. 'Special Education Week' and 'Autism and ADHD Awareness Month' Messages
  8. Apple iPhone 5c Giveaway Like-Farming Scam
  9. Fake Companies House Emails Contain Malware
  10. Mysterious Carved Tree Hoax
  11. Land Registry Debit Notification Malware Emails
  12. Jennifer's Story - Dating and Money Laundering Scam
  13. Obama Muslim Stamp - USPS Muslim Holiday Stamp Release Protest Message
  14. Pickup Truck Bus Crash Texting Warning Message
  15. No, Facebook Is NOT Removing Veteran Amputee Images
  16. 'Email Account Pending Deactivation' Phishing Scam
  17. NatWest 'Bonus Reward' Phishing Scam
  18. No, Radiation from Fukushima has NOT Killed Hundreds of Whales
  19. Google Support 'Message Blocked' Pharmacy Spam Email
  20. Russian Sleep Experiment Story
  21. Carnival Cruise Free Vacation Packages Survey Scam
  22. Angelina Jolie is Not Dead - Fake Death Message Points to Rogue App and Survey Scam
  23. Bogus LinkedIn Invites Open Drug Store Spam Sites
  24. Kitten Giveaway Scam
  25. Miley Cyrus is NOT Dead - Miley Cyrus Suicide Facebook Scam
  26. Bogus Warning - 'Russian Booksellers Looking For Children'
  27. Dave and Angela Dawes Advance Fee Lottery Scams
  28. Gang Initiation Warning Hoax - Infant Car Seat Left On Roadside
  29. Dueling Banjos Hoax
  30. Football Star Joe Montana is NOT Dead
  31. 'I Am Meth' Poem