# What's the scam behind this email? **URL:** \ **Category:** Factual Questions\ **Created:** [December 21, 2012, 1:18am UTC](https://boards.straightdope.com/t/whats-the-scam-behind-this-email/644687 "2012-12-21T01:18:40Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![Willcross](https://avatars.discourse-cdn.com/v4/letter/w/b2d939/32.png) [@Willcross](https://boards.straightdope.com/u/Willcross)\ **Post date:** [December 21, 2012, 1:18am UTC](https://boards.straightdope.com/t/whats-the-scam-behind-this-email/644687/1 "2012-12-21T01:18:40Z")
I received this email today, (and often many like this one) and it’s obviously a scam. However, I’ve often wondered how it is supposed to work. > [@](#): > > hello, > We are a trading company in INDIA ,Our customer introduce us to your > company,please we need your product kindly check attached order and > get back to us. > Regards, > Nootan Singh (Ms.) Then it goes on with the address of the company and phone number. First of all, in my email box it shows to be from Sanjay Gupta (!!!), however when I open it, it is from Nootan Singh. Couldn’t they even keep the name straight? I don’t own a business and they don’t even name the product they need. I’m afraid to open the attachment to see what their “order” is. I guess they could hope I own a business, then send me a bogus check for more than the amount. But what are the chances my product would match what they request in their “order”. Any ideas? ---
**Author:** ![Musicat](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/musicat/32/20189_2.png) [@Musicat](https://boards.straightdope.com/u/Musicat)\ **Post date:** [December 21, 2012, 2:12am UTC](https://boards.straightdope.com/t/whats-the-scam-behind-this-email/644687/2 "2012-12-21T02:12:22Z")
I get those all the time. It’s a classic come-on to get you to send something, which of course you won’t get back, ever. Then they pay with a fake check. Or they might send the check first, but it’s for too much, and they ask for a refund. If you fall for it, you trade your legitimate money for their bogus money. It’s big business and very profitable. And I certainly wouldn’t open any attachment, which might have additional surprises, or might be the actual payload for malware. ---
**Author:** ![tellyworth](https://avatars.discourse-cdn.com/v4/letter/t/977dab/32.png) [@tellyworth](https://boards.straightdope.com/u/tellyworth)\ **Post date:** [December 21, 2012, 2:36am UTC](https://boards.straightdope.com/t/whats-the-scam-behind-this-email/644687/3 "2012-12-21T02:36:02Z")
What type of file is the order? ---
**Author:** ![Willcross](https://avatars.discourse-cdn.com/v4/letter/w/b2d939/32.png) [@Willcross](https://boards.straightdope.com/u/Willcross)\ **Post date:** [December 21, 2012, 2:40am UTC](https://boards.straightdope.com/t/whats-the-scam-behind-this-email/644687/4 "2012-12-21T02:40:39Z")
> [@tellyworth](#): > > What type of file is the order? It is a .MSI file, about 620k. ---
**Author:** ![Duckster](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/duckster/32/1244_2.png) [@Duckster](https://boards.straightdope.com/u/Duckster)\ **Post date:** [December 21, 2012, 2:45am UTC](https://boards.straightdope.com/t/whats-the-scam-behind-this-email/644687/5 "2012-12-21T02:45:28Z")
> [@Willcross](#): > > It is a .MSI file, about 620k. > [@](#): > > _ **MSI** is an installer package file format used by Windows. Its name comes from the program’s original title, Microsoft Installer, which has since changed to Windows Installer. MSI files are used for installation, storage, and removal of programs. The files are contained in a package, which is used with the program’s client-side installer service, an [.EXE](http://searchcio-midmarket.techtarget.com/definition/executable) file, to open and install the program._ [What is a file extension (file format)? | Definition from TechTarget](http://whatis.techtarget.com/fileformat/MSI-Installer-package-Microsoft-Windows) Do not open it. Delete it. Delete the email without responding. Move on with your life. ---
**Author:** ![zoid](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/zoid/32/336_2.png) [@zoid](https://boards.straightdope.com/u/zoid)\ **Post date:** [December 21, 2012, 2:45am UTC](https://boards.straightdope.com/t/whats-the-scam-behind-this-email/644687/6 "2012-12-21T02:45:34Z")
> [@Willcross](#): > > It is a .MSI file, about 620k. That’s a little concerning > **[Windows Installer](https://en.wikipedia.org/wiki/Windows_Installer)** > > Windows Installer (msiexec.exe, previously known as Microsoft Installer, codename Darwin) is a software component and application programming interface (API) of Microsoft Windows used for the installation, maintenance, and removal of software. The installation information, and optionally the files themselves, are packaged in installation packages, loosely relational databases structured as COM Structured Storages and commonly known as "MSI files", from their default filename extensions. Before t... ---
**Author:** ![Willcross](https://avatars.discourse-cdn.com/v4/letter/w/b2d939/32.png) [@Willcross](https://boards.straightdope.com/u/Willcross)\ **Post date:** [December 21, 2012, 2:46am UTC](https://boards.straightdope.com/t/whats-the-scam-behind-this-email/644687/7 "2012-12-21T02:46:24Z")
> [@Musicat](#): > > I get those all the time. It’s a classic come-on to get you to send something, which of course you won’t get back, ever. Then they pay with a fake check. Or they might send the check first, but it’s for too much, and they ask for a refund. If you fall for it, you trade your legitimate money for their bogus money. > > It’s big business and very profitable. > > And I certainly wouldn’t open any attachment, which might have additional surprises, or might be the actual payload for malware. That’s what I was thinking. So do they just request a random product, like televisions. Then send the email to 20,000 people and hope some of them belong to actual TV salesmen, and an even smaller percent are gullible enough to send over 100 tv’s on credit, or for a phoney check. Now, I completely think this is possible. It costs nothing to send 20,000 emails so it seems feasible. Just wondering if this is what your thinking? ---
**Author:** ![Willcross](https://avatars.discourse-cdn.com/v4/letter/w/b2d939/32.png) [@Willcross](https://boards.straightdope.com/u/Willcross)\ **Post date:** [December 21, 2012, 2:47am UTC](https://boards.straightdope.com/t/whats-the-scam-behind-this-email/644687/8 "2012-12-21T02:47:32Z")
> [@Duckster](#): > > [What is a file extension (file format)? | Definition from TechTarget](http://whatis.techtarget.com/fileformat/MSI-Installer-package-Microsoft-Windows) > > Do not open it. Delete it. Delete the email without responding. Move on with your life. AH! Question answered. Thanks guys, message is deleted and curiosity is satisfied. ---
**Author:** ![TimeWinder](https://avatars.discourse-cdn.com/v4/letter/t/bcef8e/32.png) [@TimeWinder](https://boards.straightdope.com/u/TimeWinder)\ **Post date:** [December 21, 2012, 3:23am UTC](https://boards.straightdope.com/t/whats-the-scam-behind-this-email/644687/9 "2012-12-21T03:23:55Z")
Also, consider changing your e-mail client. In 2012, a mail program should be absolutely screaming at you or auto-junking things that have an executable attachement like that. ---
**Author:** ![Musicat](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/musicat/32/20189_2.png) [@Musicat](https://boards.straightdope.com/u/Musicat)\ **Post date:** [December 21, 2012, 4:42am UTC](https://boards.straightdope.com/t/whats-the-scam-behind-this-email/644687/10 "2012-12-21T04:42:13Z")
> [@tellyworth](#): > > What type of file is the order? > [@Willcross](#): > > It is a .MSI file, about 620k. How do you know it is a MSI file? Because the file extension is “MSI”? Ha! You do know that file names can be created in ANY combination of letters, numbers and certain special characters, don’t you? Not to mention that if your computer is set to hide extensions, the way most are from the factory, you won’t see the real one, but the fake one? ---
**Author:** ![njtt](https://avatars.discourse-cdn.com/v4/letter/n/ecd19e/32.png) [@njtt](https://boards.straightdope.com/u/njtt)\ **Post date:** [December 21, 2012, 4:54am UTC](https://boards.straightdope.com/t/whats-the-scam-behind-this-email/644687/11 "2012-12-21T04:54:32Z")
> [@Musicat](#): > > How do you know it is a MSI file? Because the file extension is “MSI”? Ha! You do know that file names can be created in ANY combination of letters, numbers and certain special characters, don’t you? Not to mention that if your computer is set to hide extensions, the way most are from the factory, you won’t see the real one, but the fake one? Yes, but why would anyone disguise a file as a dangerous filetype like MSI? ---
**Author:** ![drewtwo99](https://avatars.discourse-cdn.com/v4/letter/d/d07c76/32.png) [@drewtwo99](https://boards.straightdope.com/u/drewtwo99)\ **Post date:** [December 21, 2012, 6:26am UTC](https://boards.straightdope.com/t/whats-the-scam-behind-this-email/644687/12 "2012-12-21T06:26:05Z")
When I actually need to send a file that gmail doesn’t like (like .exe) to a friend, I like to rename it .reallybadvirus or something 😃 ---
**Author:** ![control-z](https://avatars.discourse-cdn.com/v4/letter/c/eada6e/32.png) [@control-z](https://boards.straightdope.com/u/control-z)\ **Post date:** [December 21, 2012, 9:23pm UTC](https://boards.straightdope.com/t/whats-the-scam-behind-this-email/644687/13 "2012-12-21T21:23:14Z")
> [@njtt](#): > > Yes, but why would anyone disguise a file as a dangerous filetype like MSI? I would think MSI would be a great filename extension for bad guys to use, because it’s not as well known as EXE. Running a MSI file would get the bad guys malware into the Windows installer, all the user has to do is click “Allow” or whatever to let it proceed and the bad guy potentially owns your machine. ---
**Author:** ![iamthewalrus\_3](https://avatars.discourse-cdn.com/v4/letter/i/258eb7/32.png) [@iamthewalrus\_3](https://boards.straightdope.com/u/iamthewalrus_3)\ **Post date:** [December 21, 2012, 10:18pm UTC](https://boards.straightdope.com/t/whats-the-scam-behind-this-email/644687/14 "2012-12-21T22:18:54Z")
> [@control-z](#): > > I would think MSI would be a great filename extension for bad guys to use, because it’s not as well known as EXE. Running a MSI file would get the bad guys malware into the Windows installer, all the user has to do is click “Allow” or whatever to let it proceed and the bad guy potentially owns your machine. Yeah, but that’s still an actual .msi file. The comment you were responding to was talking about abusing the “hide known file extensions” weakness in some versions of Windows. There’s no way someone trying to sneak something past the common “hide known file extensions” weakness is going to name something foo.msi.exe. They’ll go with foo.jpg.exe, or foo.txt.exe.