Sunday, September 18, 2011

With this fake failure note, the scammers weren't trying very hard

This message below didn't come from American Express. Rather, it originated at an IP address that's located near Fort Worth, Texas. The mail server gave its domain names as, which is fraudulent.

The PDF file that the site is trying to get you to download is actually a redirect link to, which is a malware/phishing website. (The real NACHA website is You can read more about this at

Don't click on links in strange messages; instead, delete them immediately.

From: "The Electronic Payments Association"
Subject: NACHA canceled transaction
Date: September 16, 2011 8:10:11 AM PDT
Canceled Transfer

Transfer ID: 48596733

Reason for rejection: See details in the report below

Transfer report: report_48596733.pdf.exe (self-extracting archive, Adobe PDF)

13450 Sunrise Valley Drive, Suite 100 Herndon, VA 20171 (703) 561-1100

2011 NACHA - The Electronic Payments Association

No comments:

Post a Comment