# Where does one report a suspicious email such as this? **URL:** \ **Category:** Factual Questions\ **Created:** [January 26, 2004, 4:31am UTC](https://boards.straightdope.com/t/where-does-one-report-a-suspicious-email-such-as-this/226106 "2004-01-26T04:31:24Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![Call\_me\_Frank](https://avatars.discourse-cdn.com/v4/letter/c/90ced4/32.png) [@Call\_me\_Frank](https://boards.straightdope.com/u/Call_me_Frank)\ **Post date:** [January 26, 2004, 4:31am UTC](https://boards.straightdope.com/t/where-does-one-report-a-suspicious-email-such-as-this/226106/1 "2004-01-26T04:31:24Z")
I just received this email and it is _obviously_ a scam of some sort and I’m wondering where I should report it. Here’s the text and full headers (sans my email address) : X-Apparently-To: my address 216.136.175.29; Sun, 25 Jan 2004 18:35:00 -0800 X-YahooFilteredBulk: 24.196.202.154 Return-Path: \<[dalton\_vishwa@geocities.com](mailto:dalton_vishwa@geocities.com)\> Received: from 24.196.202.154 (HELO [charter.com](http://charter.com)) (24.196.202.154) by [mta129.mail.sc5.yahoo.com](http://mta129.mail.sc5.yahoo.com) with SMTP; Sun, 25 Jan 2004 18:34:59 -0800 Received: from [cpe-24-196-202-154.hky.nc.charter.com](http://cpe-24-196-202-154.hky.nc.charter.com) ([cpe-24-196-202-154.hky.nc.charter.com](http://cpe-24-196-202-154.hky.nc.charter.com) [24.196.202.154]) by [charter.com](http://charter.com) (8.12.8p1/8.12.8) with ESMTP id rvqge69694 for \; Mon, 26 Jan 2004 02:26:58 -0400 (EST) Message-ID: \<[lelayr684477@geocities.com](mailto:lelayr684477@geocities.com)\> From: “FDIC” \<[Dalton\_Vishwa@geocities.com](mailto:Dalton_Vishwa@geocities.com)\> To: my address for a third time Subject: Important News About Your Bank Account Date: Mon, 26 Jan 2004 02:26:56 -0400 (EST) MIME-Version: 1.0 Content-Type: multipart/related; type=“multipart/alternative”; boundary="----=\_NextPart\_000\_000F\_01C33095.9F84B280" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2720.3000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2727.1300 Content-Length: 1197 To whom it may concern; In cooperation with the Department Of Homeland Security, Federal, State and Local Governments your account has been denied insurance from the Federal Deposit Insurance Corporation due to suspected violations of the Patriot Act. While we have only a limited amount of evidence gathered on your account at this time it is enough to suspect that currency violations may have occurred in your account and due to this activity we have withdrawn Federal Deposit Insurance on your account until we verify that your account has not been used in a violation of the Patriot Act. As a result Department Of Homeland Security Director Tom Ridge has advised the Federal Deposit Insurance Corporation to suspend all deposit insurance on your account until such time as we can verify your identity and your account information. Please verify through our IDVerify below. This information will be checked against a federal government database for identity verification. This only takes up to a minute and when we have verified your identity you will be notified of said verification and all suspensions of insurance on your account will be lifted. [http://www.fdic.gov/idverify/cgi-bin/index.htm](http://www.fdic.gov/idverify/cgi-bin/index.htm) Failure to use IDVerify below will cause all insurance for your account to be terminated and all records of your account history will be sent to the Federal Bureau of Investigation in Washington D.C. for analysis and verification. Failure to provide proper identity may also result in a visit from Local, State or Federal Government or Homeland Security Officials. Thank you for your time and consideration in this matter. Donald E. Powell Chairman Emeritus FDIC John D. Hawke, Jr. Comptroller of the Currency Michael E. Bartell Chief Information Officer ---
**Author:** ![Call\_me\_Frank](https://avatars.discourse-cdn.com/v4/letter/c/90ced4/32.png) [@Call\_me\_Frank](https://boards.straightdope.com/u/Call_me_Frank)\ **Post date:** [January 26, 2004, 4:32am UTC](https://boards.straightdope.com/t/where-does-one-report-a-suspicious-email-such-as-this/226106/2 "2004-01-26T04:32:48Z")
Woops, my mistake. The link in the email does _not_ actually take you to [fdic.gov](http://fdic.gov). I didn’t click on it but the address is fdic.goc@ an IP address. ---
**Author:** ![Horatio\_Hellpop](https://avatars.discourse-cdn.com/v4/letter/h/e5b9ba/32.png) [@Horatio\_Hellpop](https://boards.straightdope.com/u/Horatio_Hellpop)\ **Post date:** [January 26, 2004, 4:33am UTC](https://boards.straightdope.com/t/where-does-one-report-a-suspicious-email-such-as-this/226106/3 "2004-01-26T04:33:11Z")
Well, start with your bank… ---
**Author:** ![TJdude825](https://avatars.discourse-cdn.com/v4/letter/t/dec6dc/32.png) [@TJdude825](https://boards.straightdope.com/u/TJdude825)\ **Post date:** [January 26, 2004, 4:36am UTC](https://boards.straightdope.com/t/where-does-one-report-a-suspicious-email-such-as-this/226106/4 "2004-01-26T04:36:58Z")
I would [contact the FDIC](http://www.fdic.gov/about/contact/ask/index.html) or [the DHS](http://www.dhs.gov/dhspublic/contactus). I don’t know if any laws are being broken, but they’d probably want to know about this. ---
**Author:** ![Call\_me\_Frank](https://avatars.discourse-cdn.com/v4/letter/c/90ced4/32.png) [@Call\_me\_Frank](https://boards.straightdope.com/u/Call_me_Frank)\ **Post date:** [January 26, 2004, 5:12am UTC](https://boards.straightdope.com/t/where-does-one-report-a-suspicious-email-such-as-this/226106/5 "2004-01-26T05:12:22Z")
Heh, didn’t expect them to have a press release about it, lol… [http://www.fdic.gov/news/news/press/2004/pr0604.html](http://www.fdic.gov/news/news/press/2004/pr0604.html) ---
**Author:** ![leenmi](https://avatars.discourse-cdn.com/v4/letter/l/f1d935/32.png) [@leenmi](https://boards.straightdope.com/u/leenmi)\ **Post date:** [January 26, 2004, 5:13am UTC](https://boards.straightdope.com/t/where-does-one-report-a-suspicious-email-such-as-this/226106/6 "2004-01-26T05:13:12Z")
[This article](http://news.com.com/2100-7349_3-5146716.html?tag=nefd_top) seems to be about the scam. ---
**Author:** ![silk1976](https://avatars.discourse-cdn.com/v4/letter/s/8edcca/32.png) [@silk1976](https://boards.straightdope.com/u/silk1976)\ **Post date:** [January 26, 2004, 5:15am UTC](https://boards.straightdope.com/t/where-does-one-report-a-suspicious-email-such-as-this/226106/7 "2004-01-26T05:15:17Z")
[www.snopes.com](http://www.snopes.com) - search for FDIC - it’s listed in the “New Additions” section. ---
**Author:** ![Reepicheep](https://avatars.discourse-cdn.com/v4/letter/r/ed655f/32.png) [@Reepicheep](https://boards.straightdope.com/u/Reepicheep)\ **Post date:** [January 26, 2004, 6:58am UTC](https://boards.straightdope.com/t/where-does-one-report-a-suspicious-email-such-as-this/226106/8 "2004-01-26T06:58:01Z")
> [@Call me Frank](#): > > Woops, my mistake. The link in the email does _not_ actually take you to [fdic.gov](http://fdic.gov). I didn’t click on it but the address is fdic.goc@ an IP address. Forgive the hijack please, but how do you tell that it takes you to [fdc.gov](http://fdc.gov)@ IP address of scammer? I know that anything that comes before the @ is to be ignored, so it is a redirect to the IP of the scammer, but I don’t see the @. Could someone please expand my tech understanding? ---
**Author:** ![Call\_me\_Frank](https://avatars.discourse-cdn.com/v4/letter/c/90ced4/32.png) [@Call\_me\_Frank](https://boards.straightdope.com/u/Call_me_Frank)\ **Post date:** [January 26, 2004, 7:05am UTC](https://boards.straightdope.com/t/where-does-one-report-a-suspicious-email-such-as-this/226106/9 "2004-01-26T07:05:03Z")
> [@Reepicheep](#): > > Forgive the hijack please, but how do you tell that it takes you to [fdc.gov](http://fdc.gov)@ IP address of scammer? I know that anything that comes before the @ is to be ignored, so it is a redirect to the IP of the scammer, but I don’t see the @. Could someone please expand my tech understanding? I use MS Internet Explorer, so this is the only clarification I can give you: 1. When you hover the cursor over a link, in the bottom, left corner of the window the address that the link leads to is printed. If you use IE it’s where it says “done” when a page is finished loading. 2. If you right click on a link and select properties you can see where the link leads to in the Address: field. For example, right click on User CP, select properties part of the information will be "Address (URL): [http://boards.straightdope.com/sdmb/usercp.php?"](http://boards.straightdope.com/sdmb/usercp.php?%22) ---
**Author:** ![Call\_me\_Frank](https://avatars.discourse-cdn.com/v4/letter/c/90ced4/32.png) [@Call\_me\_Frank](https://boards.straightdope.com/u/Call_me_Frank)\ **Post date:** [January 26, 2004, 7:11am UTC](https://boards.straightdope.com/t/where-does-one-report-a-suspicious-email-such-as-this/226106/10 "2004-01-26T07:11:11Z")
This is not my night for thoroughness :smack: The two things I mentioned won’t reveal an alternate link for the link in my OP because I copied the _text_ of the message, not the HTML. So the link in my OP is not actually the link that came in the email. ---
**Author:** ![Reepicheep](https://avatars.discourse-cdn.com/v4/letter/r/ed655f/32.png) [@Reepicheep](https://boards.straightdope.com/u/Reepicheep)\ **Post date:** [January 26, 2004, 7:20am UTC](https://boards.straightdope.com/t/where-does-one-report-a-suspicious-email-such-as-this/226106/11 "2004-01-26T07:20:03Z")
> [@Call me Frank](#): > > I use MS Internet Explorer, so this is the only clarification I can give you: > > 1. When you hover the cursor over a link, in the bottom, left corner of the window the address that the link leads to is printed. If you use IE it’s where it says “done” when a page is finished loading. > > 2. If you right click on a link and select properties you can see where the link leads to in the Address: field. For example, right click on User CP, select properties part of the information will be "Address (URL): [http://boards.straightdope.com/sdmb/usercp.php?"](http://boards.straightdope.com/sdmb/usercp.php?%22) Thanks for fighting my ignorance. ---
**Author:** ![Tim\_T-Bonham.net](https://avatars.discourse-cdn.com/v4/letter/t/46a35a/32.png) [@Tim\_T-Bonham.net](https://boards.straightdope.com/u/Tim_T-Bonham.net)\ **Post date:** [January 26, 2004, 7:59am UTC](https://boards.straightdope.com/t/where-does-one-report-a-suspicious-email-such-as-this/226106/12 "2004-01-26T07:59:32Z")
**Where does one report a suspicious email such as this?** I’d say don’t bother reporting it anywhere. Just like you should **not** click on any link that says “click here to be removed…” on a SPAM email. There seems to be very little any government agency could really do about this. And any time they spend responding to people who report such scams, it will just use up time they could have spent on doing their mission. The exception to this would be if you know you are the very first person to receive a _new_ type of spam email. You could check that by looking at the obvious places (snopes, urban legends, etc.) or just a simple google search for it. Most likely you’ll see warnings already posted about it (like there were on this one). ---
**Author:** ![Call\_me\_Frank](https://avatars.discourse-cdn.com/v4/letter/c/90ced4/32.png) [@Call\_me\_Frank](https://boards.straightdope.com/u/Call_me_Frank)\ **Post date:** [January 26, 2004, 8:04am UTC](https://boards.straightdope.com/t/where-does-one-report-a-suspicious-email-such-as-this/226106/13 "2004-01-26T08:04:11Z")
> [@t-bonham@scc.net](#): > > **Where does one report a suspicious email such as this?** The exception to this would be if you know you are the very first person to receive a _new_ type of spam email. You could check that by looking at the obvious places (snopes, urban legends, etc.) or just a simple google search for it. Most likely you’ll see warnings already posted about it (like there were on this one). That’s the thing, though. I _did_ do a Yahoo!\* search for this email…didn’t get any hits. Maybe that’s because of the manner in which I conducted my search…namely pick a random passage and search for that, and then search for the enclosed link and the sender address. None of those searches turned anything up, so I didn’t know what the status of this scam was. - In my experience Yahoo! turns up the same results as Google, for those out there who would say “You should have used Google…” ---
**Author:** ![RedNaxela](https://avatars.discourse-cdn.com/v4/letter/r/ad7895/32.png) [@RedNaxela](https://boards.straightdope.com/u/RedNaxela)\ **Post date:** [January 26, 2004, 3:01pm UTC](https://boards.straightdope.com/t/where-does-one-report-a-suspicious-email-such-as-this/226106/14 "2004-01-26T15:01:02Z")
You could also try submitting it to [Anti-Phishing.org](http://www.antiphishing.org), which maintains an archive of such scams and works to get them shut down. [Disclaimer: I work for one of the companies involved in this organization.] (And **t-bonham** , it does indeed do some good to report such scams somewhere, whether to Anti-Phishing, Snopes, the FCC, or what have you: they can get the ISP to shut down the account, and perhaps also put some pressure on Microsoft to close the relevant security holes in Internet Explorer, such as the one that **Call me Frank** noted that allows the scammers to obfuscate the real URL.) ---
**Author:** ![Grave](https://avatars.discourse-cdn.com/v4/letter/g/71c47a/32.png) [@Grave](https://boards.straightdope.com/u/Grave)\ **Post date:** [January 26, 2004, 7:04pm UTC](https://boards.straightdope.com/t/where-does-one-report-a-suspicious-email-such-as-this/226106/15 "2004-01-26T19:04:51Z")
> [@Reepicheep](#): > > Forgive the hijack please, but how do you tell that it takes you to [fdc.gov](http://fdc.gov)@ IP address of scammer? I know that anything that comes before the @ is to be ignored, so it is a redirect to the IP of the scammer, but I don’t see the @. Could someone please expand my tech understanding? More info : The info in front of the @ is **not** just ignored. It can be used to transmit useful data, and that is why it exists. Consider this: [user:pass@web.server.com](mailto:user:pass@web.server.com) That would log you into a server as the user account, with the password pass. This can be handy to set up in link to avoid log-ons and such. The problem is that, AFAIK, webservers don’t generate a visible error condition for invalid data. Therefore [microsoft.com@1.2.3.com](mailto:microsoft.com@1.2.3.com) will just dump you at [1.2.3.com](http://1.2.3.com), with no indication that something wonky just happened. Worse yet is the flaw that hides the end of a URL (an Internet Explorer only flaw, luckily), which is explained and demonstrated [here](http://www.zapthedingbat.com/security/ex01/vun1.htm). ---
**Author:** ![Tapioca\_Dextrin](https://avatars.discourse-cdn.com/v4/letter/t/3d9bf3/32.png) [@Tapioca\_Dextrin](https://boards.straightdope.com/u/Tapioca_Dextrin)\ **Post date:** [January 26, 2004, 7:42pm UTC](https://boards.straightdope.com/t/where-does-one-report-a-suspicious-email-such-as-this/226106/16 "2004-01-26T19:42:27Z")
> [@t-bonham@scc.net](#): > > There seems to be very little any government agency could really do about this. And any time they spend responding to people who report such scams, it will just use up time they could have spent on doing their mission. But the [FDIC](http://www.fdic.gov/news/news/press/2004/pr0604.html) and the [FBI](http://www.fbi.gov/fbi-fdic.htm) disagree > [@](#): > > The FDIC and the FBI are attempting to identify the source of the emails and disrupt the transmission. Until this is achieved, consumers are asked to report any similar attempts to obtain this information to the FDIC by sending information to [alert@fdic.gov](mailto:alert@fdic.gov). ---
**Author:** ![Zigarre](https://avatars.discourse-cdn.com/v4/letter/z/bbce88/32.png) [@Zigarre](https://boards.straightdope.com/u/Zigarre)\ **Post date:** [January 27, 2004, 1:02am UTC](https://boards.straightdope.com/t/where-does-one-report-a-suspicious-email-such-as-this/226106/17 "2004-01-27T01:02:35Z")
I would be very curious about how this email targeted you as an account holder. Was it a mass emailing shotgun type approach, or did they actually target known account holders? Any ideas? ---
**Author:** ![Tapioca\_Dextrin](https://avatars.discourse-cdn.com/v4/letter/t/3d9bf3/32.png) [@Tapioca\_Dextrin](https://boards.straightdope.com/u/Tapioca_Dextrin)\ **Post date:** [January 27, 2004, 1:22am UTC](https://boards.straightdope.com/t/where-does-one-report-a-suspicious-email-such-as-this/226106/18 "2004-01-27T01:22:46Z")
Everybody (well those of us who have a public e-mail address) gets them. It’s just plain old spam/scam stuff. The last major one claimed to be from citibank > **[Citibank Fake Login Scam](https://www.snopes.com/fact-check/citibank-3/)** > > Is Citibank sending out notices asking customers to log in and verify their accounts? ---
**Author:** ![Call\_me\_Frank](https://avatars.discourse-cdn.com/v4/letter/c/90ced4/32.png) [@Call\_me\_Frank](https://boards.straightdope.com/u/Call_me_Frank)\ **Post date:** [January 27, 2004, 4:11am UTC](https://boards.straightdope.com/t/where-does-one-report-a-suspicious-email-such-as-this/226106/19 "2004-01-27T04:11:06Z")
> [@Tapioca Dextrin](#): > > Everybody (well those of us who have a public e-mail address) gets them. It’s just plain old spam/scam stuff. The last major one claimed to be from citibank > > [http://www.snopes.com/inboxer/scams/citibank3.asp](http://www.snopes.com/inboxer/scams/citibank3.asp) I agree with **Tapioca**. You have to think about spam for a minute. How many hundreds of thousands of emails do they send versus how many suckers do they actually hook? The whole reason spam is profitable is because you can target thousands of people with very little cost to you. So this was just a blind barrage, if you as me… ---
**Author:** ![freewill39](https://avatars.discourse-cdn.com/v4/letter/f/d2c977/32.png) [@freewill39](https://boards.straightdope.com/u/freewill39)\ **Post date:** [January 27, 2004, 2:26pm UTC](https://boards.straightdope.com/t/where-does-one-report-a-suspicious-email-such-as-this/226106/20 "2004-01-27T14:26:28Z")
Yeah, I get emails like this all the time, of all shapes and sizes. In fact, I wouldn’t be shocked if I’d actually gotten the **very** same email. It looks familiar. I just delete them unread. There is so much horse shit out on the internet today, I’ve just become desensitized by it. (-: