Fake Emails Warning
Published / Last Updated on 26/05/2017
Fake FinancialAdvice.net Emails.
We are aware of some fake emails being circulated using our name/brand. This does not just happen to us, it happens to many organisations, large and small. Even the Financial Conduct Authority (FCA) issued a similar warning last week and HMRC have been suffering for years. In fact, we have all probably received fake HMRC emails telling us we have a refund!
This week it was our turn and an email was sent to one of our staff supposedly from one of our directors:
Image 1 - it all looks very genuine: a valid ‘to’ email address and a valid ‘from’ email address
Spotting the problem:
- James Roberts-Clark is our director’s legal name. However, he has always used his middle name ‘Ashley’ and original surname ‘Clark’ in life, school and work.
- The name James Roberts-Clark is only published online at Companies House and on the Financial Conduct Authority Register.
- There are no regulatory details or signature text in the email, just “sent from my iPhone”. We do not send email from our mobile telephones to clients.
- Someone is therefore trying to ‘spoof’ the email address and trick people.
Check the source code:
For every email you can check the properties and source code. This will tell you where the email came from. Look at the following:
Image 2 – properties/source code
Image 3 – in properties/source code look at the reply/return path ‘ashley@financialadvice.com-k.pw’ . This is clearly not a financialadvice.net email address.
Image 4 – look at the ‘received from’ mail server ‘uk-x.pw’ and ‘unknown mail’ server as highlighted.
Image 5 – finally, look at the reply address when you click on the button to reply to the email, again it is ‘ashley@financialadvice.com-k.pw’ – clearly not ours.
OURS ARE GENUINE, Certified and Checked Email Addresses
Please beware of emails that do not look genuine. Not just us, but all emails that you receive. Whilst all our emails sent out to clients are verified by our mail server before they are sent as validated from a valid email address and server source, crooks can try and impersonate any email address by using an ‘alias’ email address hiding their actual email address but then routing it through a ‘rogue’ server that does not force it to be checked and validated.
We cannot stop phishing, it is a global/government security problem, we can only report it to the server and domain name registrars of the rogue server/domain as abuse and potential phishing abuse to ban and close down both the domain name and the server.