# Some asswipe just tried to phish me and USED THEIR OWN CONTACT INFO **URL:** \ **Category:** The BBQ Pit\ **Created:** [November 21, 2008, 5:58pm UTC](https://boards.straightdope.com/t/some-asswipe-just-tried-to-phish-me-and-used-their-own-contact-info/473876 "2008-11-21T17:58:14Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![Beadalin](https://avatars.discourse-cdn.com/v4/letter/b/3be4f8/32.png) [@Beadalin](https://boards.straightdope.com/u/Beadalin)\ **Post date:** [November 21, 2008, 5:58pm UTC](https://boards.straightdope.com/t/some-asswipe-just-tried-to-phish-me-and-used-their-own-contact-info/473876/1 "2008-11-21T17:58:14Z")
Fucking awesome. Please help me think of ways to bring the hammer down. Here’s an email I just received to my Hotmail account: > [@](#): > > Account verification request - Please respond.‏ > From: \ on behalf of Citi Bank ([accounts@citibank.com](mailto:accounts@citibank.com)) > Sent: Fri 11/21/08 9:37 AM > To: > > Dear Citi Bank client, > This is a courtesy reminder that your Online Account needs to be verified: > > In order to receive uninterrupted services, please verify your information immediately. > > To verify your account, please click the link below, log in and follow the provided steps: > > [Credit Cards, Banking, Mortgage, Personal Loans | Citi.com](https://online.citibank.com/US/JPS/portal/Index.do) > > Regards, > Citi Bank a) I am not a Citibank customer b) Citibank is one word, not two c) I don’t think they conduct official correspondance via students or alumni at the University of South Carolina So far I have marked the email as a phishing scam (which you can do in Hotmail) and sent the email to the contact information I could find on the USC website. What else can I do? ---
**Author:** ![Beadalin](https://avatars.discourse-cdn.com/v4/letter/b/3be4f8/32.png) [@Beadalin](https://boards.straightdope.com/u/Beadalin)\ **Post date:** [November 21, 2008, 6:03pm UTC](https://boards.straightdope.com/t/some-asswipe-just-tried-to-phish-me-and-used-their-own-contact-info/473876/2 "2008-11-21T18:03:09Z")
Also reported it to Citibank. ---
**Author:** ![Free\_Range\_Otter](https://avatars.discourse-cdn.com/v4/letter/f/ba8739/32.png) [@Free\_Range\_Otter](https://boards.straightdope.com/u/Free_Range_Otter)\ **Post date:** [November 21, 2008, 6:04pm UTC](https://boards.straightdope.com/t/some-asswipe-just-tried-to-phish-me-and-used-their-own-contact-info/473876/3 "2008-11-21T18:04:21Z")
Can a phisher hijack someone’s email address to send out emails? ---
**Author:** ![Sunspace](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/sunspace/32/1250_2.png) [@Sunspace](https://boards.straightdope.com/u/Sunspace)\ **Post date:** [November 21, 2008, 6:10pm UTC](https://boards.straightdope.com/t/some-asswipe-just-tried-to-phish-me-and-used-their-own-contact-info/473876/4 "2008-11-21T18:10:01Z")
> [@Free\_Range\_Otter](#): > > Can a phisher hijack someone’s email address to send out emails? They can send emails from their own servers bearing false origination addresses. It wouldn’t be originating from the false address; it would just look that way to the recipient. I got a bunch of spam last week that bore my own address in the “From:” field. Email is completely unprotected that way. On the other hand, I’ve heard that some malware installs an email server that sends spam under remote control by a distant spammer… ---
**Author:** ![Marathon](https://avatars.discourse-cdn.com/v4/letter/m/7cd45c/32.png) [@Marathon](https://boards.straightdope.com/u/Marathon)\ **Post date:** [November 21, 2008, 6:10pm UTC](https://boards.straightdope.com/t/some-asswipe-just-tried-to-phish-me-and-used-their-own-contact-info/473876/5 "2008-11-21T18:10:11Z")
usc.edu is University of Southern California, not University of South Carolina. ---
**Author:** ![Fish\_Nya](https://avatars.discourse-cdn.com/v4/letter/f/8edcca/32.png) [@Fish\_Nya](https://boards.straightdope.com/u/Fish_Nya)\ **Post date:** [November 21, 2008, 6:11pm UTC](https://boards.straightdope.com/t/some-asswipe-just-tried-to-phish-me-and-used-their-own-contact-info/473876/6 "2008-11-21T18:11:21Z")
> [@Free\_Range\_Otter](#): > > Can a phisher hijack someone’s email address to send out emails? Yes. We had a student do that at my school over the summer. It’s crap for the students, as some colleges have pretty low security. ---
**Author:** ![gazpacho](https://avatars.discourse-cdn.com/v4/letter/g/6f9a4e/32.png) [@gazpacho](https://boards.straightdope.com/u/gazpacho)\ **Post date:** [November 21, 2008, 6:12pm UTC](https://boards.straightdope.com/t/some-asswipe-just-tried-to-phish-me-and-used-their-own-contact-info/473876/7 "2008-11-21T18:12:01Z")
Beadalin, What makes you think that the email address in the from field has any relation to the people that sent it? The USC email account is just there to hide who really sent the mail and to help evade spam filters. ---
**Author:** ![Beadalin](https://avatars.discourse-cdn.com/v4/letter/b/3be4f8/32.png) [@Beadalin](https://boards.straightdope.com/u/Beadalin)\ **Post date:** [November 21, 2008, 6:16pm UTC](https://boards.straightdope.com/t/some-asswipe-just-tried-to-phish-me-and-used-their-own-contact-info/473876/8 "2008-11-21T18:16:37Z")
You’re right, it’s Southern California. At any rate, this is the first time I’d ever seen “on behalf of” in the From line, and jumped to conclusions. Of course it’s more than possible (and really likely, even) that someone highjacked this person’s account. Either way, I think it’s an appropriate response to report it to USC and Citibank. ---
**Author:** ![DudleyGarrett](https://avatars.discourse-cdn.com/v4/letter/d/d9b06d/32.png) [@DudleyGarrett](https://boards.straightdope.com/u/DudleyGarrett)\ **Post date:** [November 21, 2008, 6:18pm UTC](https://boards.straightdope.com/t/some-asswipe-just-tried-to-phish-me-and-used-their-own-contact-info/473876/9 "2008-11-21T18:18:24Z")
USC account compromised, Sherlock. ---
**Author:** ![Giraffe](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/giraffe/32/129_2.png) [@Giraffe](https://boards.straightdope.com/u/Giraffe)\ **Post date:** [November 21, 2008, 6:19pm UTC](https://boards.straightdope.com/t/some-asswipe-just-tried-to-phish-me-and-used-their-own-contact-info/473876/10 "2008-11-21T18:19:19Z")
I removed the email address from the OP, since it could well be a hijacked email account and not that of an actual spammer. ---
**Author:** ![Anonymous\_Coward](https://avatars.discourse-cdn.com/v4/letter/a/94ad74/32.png) [@Anonymous\_Coward](https://boards.straightdope.com/u/Anonymous_Coward)\ **Post date:** [November 21, 2008, 6:21pm UTC](https://boards.straightdope.com/t/some-asswipe-just-tried-to-phish-me-and-used-their-own-contact-info/473876/11 "2008-11-21T18:21:52Z")
I have to go with spoofed email address, not compromised. I get lots of bounce backs from spam using my email address as the From: field, and I know my systems are secure and that the emails in question did not originate from my servers. ---
**Author:** ![Beadalin](https://avatars.discourse-cdn.com/v4/letter/b/3be4f8/32.png) [@Beadalin](https://boards.straightdope.com/u/Beadalin)\ **Post date:** [November 21, 2008, 6:21pm UTC](https://boards.straightdope.com/t/some-asswipe-just-tried-to-phish-me-and-used-their-own-contact-info/473876/12 "2008-11-21T18:21:57Z")
Thanks, Giraffe. ---
**Author:** ![Lanzy](https://avatars.discourse-cdn.com/v4/letter/l/74df32/32.png) [@Lanzy](https://boards.straightdope.com/u/Lanzy)\ **Post date:** [November 21, 2008, 6:30pm UTC](https://boards.straightdope.com/t/some-asswipe-just-tried-to-phish-me-and-used-their-own-contact-info/473876/13 "2008-11-21T18:30:31Z")
I got this same email yesterday, reported it. ---
**Author:** ![sailor](https://avatars.discourse-cdn.com/v4/letter/s/a587f6/32.png) [@sailor](https://boards.straightdope.com/u/sailor)\ **Post date:** [November 21, 2008, 6:38pm UTC](https://boards.straightdope.com/t/some-asswipe-just-tried-to-phish-me-and-used-their-own-contact-info/473876/14 "2008-11-21T18:38:34Z")
> [@Beadalin](#): > > this is the first time I’d ever seen “on behalf of” in the From line I have been receiving such emails lately from legitimate sources (From A on behalf of B). What does it mean, what is the purpose, how is it done, etc? ---
**Author:** ![Beadalin](https://avatars.discourse-cdn.com/v4/letter/b/3be4f8/32.png) [@Beadalin](https://boards.straightdope.com/u/Beadalin)\ **Post date:** [November 21, 2008, 6:42pm UTC](https://boards.straightdope.com/t/some-asswipe-just-tried-to-phish-me-and-used-their-own-contact-info/473876/15 "2008-11-21T18:42:38Z")
Misspoke. I see it all the time in my work environment. Usually it’s administrative assistants who have full access to the Outlook accounts of the people they support. So admin Tim can schedule a meeting or send an email on VP Tom’s behalf. In my hasty rage, I’d assumed that the person sending “on behalf of Citi Bank” was someone who had created a phishing account and was too dumb to log into that account directly. More fool me. ---
**Author:** ![Derleth](https://avatars.discourse-cdn.com/v4/letter/d/b9e5f3/32.png) [@Derleth](https://boards.straightdope.com/u/Derleth)\ **Post date:** [November 21, 2008, 6:44pm UTC](https://boards.straightdope.com/t/some-asswipe-just-tried-to-phish-me-and-used-their-own-contact-info/473876/16 "2008-11-21T18:44:37Z")
> [@sailor](#): > > I have been receiving such emails lately from legitimate sources (From A on behalf of B). What does it mean, what is the purpose, how is it done, etc? It doesn’t mean anything except that someone edited the From: field of their email. None of this is meaningful because any part of the header that comes from the spammer is assumed to be an outright lie. ---
**Author:** ![Eva\_Luna](https://avatars.discourse-cdn.com/v4/letter/e/e495f1/32.png) [@Eva\_Luna](https://boards.straightdope.com/u/Eva_Luna)\ **Post date:** [November 21, 2008, 7:52pm UTC](https://boards.straightdope.com/t/some-asswipe-just-tried-to-phish-me-and-used-their-own-contact-info/473876/17 "2008-11-21T19:52:11Z")
> [@sailor](#): > > I have been receiving such emails lately from legitimate sources (From A on behalf of B). What does it mean, what is the purpose, how is it done, etc? Outlook can be configured that way. My boss sometimes dictates and has me or his secretary send e-mails on his behalf that way, because he types like e.e. cummings and it takes him forever. (I don’t know how to configure it that way; our sysadmin did it for me.) ---
**Author:** ![sailor](https://avatars.discourse-cdn.com/v4/letter/s/a587f6/32.png) [@sailor](https://boards.straightdope.com/u/sailor)\ **Post date:** [November 21, 2008, 9:22pm UTC](https://boards.straightdope.com/t/some-asswipe-just-tried-to-phish-me-and-used-their-own-contact-info/473876/18 "2008-11-21T21:22:19Z")
Oh, I see, silly of me, of course I know how to do it. I often do emails that do To: Shrimpface\ From: Fishface\ So all I need to do is To: Shrimpface\ From: “Fishface on behalf of B. Obama”\ I just wasn’t thinking. The email addresses are the only thing that counts. You can put anything you want in the rest. I had never seen it and now it is becoming common. Hi, **Eva Luna** , I’m back. ---
**Author:** ![gazpacho](https://avatars.discourse-cdn.com/v4/letter/g/6f9a4e/32.png) [@gazpacho](https://boards.straightdope.com/u/gazpacho)\ **Post date:** [November 21, 2008, 9:40pm UTC](https://boards.straightdope.com/t/some-asswipe-just-tried-to-phish-me-and-used-their-own-contact-info/473876/19 "2008-11-21T21:40:01Z")
> [@sailor](#): > > Oh, I see, silly of me, of course I know how to do it. I often do emails that do > > To: Shrimpface\ > From: Fishface\ > > So all I need to do is > > To: Shrimpface\ > From: “Fishface on behalf of B. Obama”\ > > I just wasn’t thinking. The email addresses are the only thing that counts. You can put anything you want in the rest. I had never seen it and now it is becoming common. > > Hi, **Eva Luna** , I’m back. Sailor. It is more than that you can put anything at all you want in the from line. It might not be easy with outlook but it is with other programs. You could send a mail. To: Shrimpface\ From: “B. Obama”\ Nothing along the way verifies that it is from [whitehouse.gov](http://whitehouse.gov) ---
**Author:** ![Voyager](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/voyager/32/133_2.png) [@Voyager](https://boards.straightdope.com/u/Voyager)\ **Post date:** [November 21, 2008, 11:17pm UTC](https://boards.straightdope.com/t/some-asswipe-just-tried-to-phish-me-and-used-their-own-contact-info/473876/20 "2008-11-21T23:17:05Z")
Mail readers can usually let you see the full headers, which can tell you at least a few of the drops the message went through. This can often tell you if the from line is spoofed. You can get open source mailer code, and with these you fill in the from line explicitly. If the headers make it look like the mail actually came from USC, then the account has been compromised. Often people steal mailing lists from machines that have been compromised, or harvest addresses from the web, and stick in random from addresses. Does the link you gave actually go to citibank. Often you can tell that the link printed is not the actual link, which can be verified looking at the url you wind up in. Half the time it has been taken down by the time I click on it to fill out nasty things in the fields. (I do it from UNIX machines where I don’t have to worry about malware.) [Next page](https://boards.straightdope.com/t/some-asswipe-just-tried-to-phish-me-and-used-their-own-contact-info/473876.md?page=2)