I totally almost fell into this scam. I use my online Bank of America account avidly every day for my business and personal.
I entered in my username and my mother’s middle name…then it took me to the login screen. For those who don’t know, BoA has a login screen where you have to verify a picture that you chose for extra security. Anyway, the picture didn’t load, it acted as if it was taking a moment and I started entering my password in, just by force of habit.
that’s when i and happened to look up at the URL and saw a http://… not a https://
i would have been totally fucked if i would have entered my password. So instead, i entered “FUCK YOU” for my password and everything else (as you can see) and of coarse, everything went through just fine as if it was all correct.
JUST A HEADS UP…BE AWARE. I feel i am usually really good at identifying these sort of scams, but was almost had.
soo. a spoofed email? I see the same picture three times
whats the reply to?
you do realize http and https are essentially the same thing… https is secure where as http is not… the domain is the important part. bankofamerica.com
EVERYTIME i get any email from banks, cards, ebay, etc… and they have a “new alert” or “message” with a link to login, i pop open a new browser & type in the url.
Some good rules to follow when it comes to banking emails.
Your bank will never email you asking to update your information.
Never click on a link sent to you in an email claiming to be your bank. Open your browser window and go to the address yourself.
I’ve seen much better scammer emails than the one you got. One of them even managed to overlay an image in the address bar with the real https address so it look 100% legit. The only way you could see it was an overlay was to drag the browser window around the screen and the overlay couldn’t quite keep up, revealing the bogus address under it. As soon as you stopped moving the window the overlay would snap right back into perfect position. We spent half a day trying to figure how the hell the scammer did it because we were impressed. Impressed in that, “wow, that’s evil as hell but I have to give you credit for the effort you put in” kind of way.
That’s the very first thing I noticed about the screenshots. I always make sure I examine the URL before entering any info. It’s force of habit for me now.
