It seems that lately there’s been an increase in the number of “financial company” emails advising me that my invoice has gone unpaid or that I need to fill out a form to complete some other financial transaction I never initiated. Here’s the latest email and, oddly enough, this one even has correct contact information for Fiserv. It also includes what is probably their standard email disclaimer at the bottom. And best of all, the zip file name in the email matches that of the attached file. Still, that doesn’t make this email legitimate.
Attached is the unpaid invoice (Invoice_6954171.zip) received from your bank.
Please let me know if you need anything else.
Thank you
Millard_Rosa
Payroll Office Manager
255 Fiserv Drive
PO Box 979
Brookfield WI 53008
Terry Ambrose says
You’re welcome Jacqueline! I’m glad it did some good!
Jacqueline says
I received the same email, just a different name in the body – DELETED 🙂 Thanks for posting about this, Terry!
Attached is the unpaid invoice (Invoice_6110434.zip) received from your bank.
Please let me know if you need anything else.
Thank you
Emil_Aguirre
Payroll Office Manager
255 Fiserv Drive
PO Box 979
Brookfield
WI 53008
Terry Ambrose says
Hey CW, the emails aren’t necessarily from the companies who are targeted. For instance, while the email SAYS it’s from Fiserv, the email return address is American Express. However, the IP address that this came from is 130.221.115.104, which is not registered to American Express, but to an ISP with a large block of IPs that it probably uses for shared internet service. The scammers are all very tricky and getting more sophisticated, so these things are becoming more of a problem.
CW says
Recieved the same email this morning from:
Jayson_Villanueva @ Fiserv
I recently started receiving emails from Dun & Bradstreet with a Zip file attached as well. There is definitely an increase in FORTUNE 1000-Type Corporations who are getting their email servers hacked, which is a little scarier for the average person as you expect these companies to have the proper security…
Mark M says
Got similar. Tried calling the number and it is disconnected. Thankfully, I didn’t open the file. Smelled bad from the moment I saw it.
Terry Ambrose says
Interesting news about the phone. I hadn’t tried that number. Toll free is unusual!
susan says
It looks liek their standard e mail disclaimer, but did you try calling the number listed? Sounds like an xrated line to me.
Terry Ambrose says
Carlos, I haven’t opened that particular email, so I’m not sure, but I’d assume it either contains malware that would be downloaded when you open the zip file or a link to a site which would do the same. I haven’t had time to pursue this particular one, but when this many reports start coming in, there’s a good chance it’s going to be malicious. Unfortunately, I can’t tell you with 100% certainty that that’s the case. Best not to chance it, however.
Carlos says
Okay, I received the same email with a different zip number. Anybody know that the angle is on this scam? Is there a virus in the zip file? Are they just looking for some poor soul who will pay? Here is the email I recieved:
Attached is the unpaid invoice (Invoice_1141379.zip) received from your bank.
Please let me know if you need anything else.
Thank you
Dillon_Trujillo
Payroll Office Manager
255 Fiserv Drive
PO Box 979
Brookfield
WI 53008
Terry Ambrose says
Thanks for the comments, Eve and Murdock! Looks like this one really made the rounds!
Eve says
I received the same email! I knew it was fishy. Looked like this:
Attached is the unpaid invoice (Invoice_9231783.zip) received from your bank.
Please let me know if you need anything else.
Thank you
Elvira_Mackey
Payroll Office Manager
255 Fiserv Drive
PO Box 979
Brookfield
WI 53008
Murdock says
Same thing, different name
Attached is the unpaid invoice (Invoice_9940117.zip) received from your bank.
Please let me know if you need anything else.
Thank you
Elliot_Clifton
Terry Ambrose says
Hi Eric,
Thanks for the comment. Indeed, there are just tons of these guys out there. I’m half serious when I say that there was probably a sale on the program recently and lots of these guys have bought in. Makes it tough for the rest of us!
Terry
Eric says
Seems i got the same email with a different invoice numbber and from Loretta _Newell