Adobe Invoice Email Scam
Our analysis of the "Adobe Invoice" email has revealed that it is a form of spam. This email is designed to resemble an invoice, claiming to bill the recipient for a year-long subscription to Adobe. However, it serves as a deceptive tactic to lure recipients into a callback scam. These schemes often aim to trick victims into divulging private information or engaging in financial transactions.
The spam email is disguised as an invoice for a year-long Adobe subscription, with a total amount of $312.49 USD specified. Notably, the email fails to specify which particular Adobe product the subscription pertains to. It also provides a telephone number for supposed "customer support."
It is crucial to emphasize that this invoice is fraudulent and has no affiliation with Adobe Inc. or any of its products or services.
The objective of this spam email is to persuade recipients to call the fraudulent helpline. Callback scams can unfold entirely over the phone, with fake support agents attempting to coerce victims into revealing sensitive information, making financial transactions, or downloading and installing malware, such as trojans, ransomware, or cryptominers.
These scams frequently incorporate elements of tech support scams, with scammers manipulating remote access software. For more information on this topic, you can refer to our articles on commonly used remote access software like UltraViewer and TeamViewer.
How Do Many Scams that Rely on Active Victim Interaction Work?
Callback scams can involve scammers gaining remote access to victims' devices, often under the pretense of assisting with subscription cancellations, refunds, product installations, or addressing perceived issues or threats. While maintaining this connection, cybercriminals may pose as support technicians, all the while compromising the victim's security by removing legitimate security tools, installing counterfeit antivirus software, exfiltrating data, obtaining funds, downloading and installing malware, or engaging in other malicious activities.
The information of interest to these scammers primarily includes login credentials for accounts (such as email, social media, e-commerce, online banking, and cryptocurrency wallets), personally identifiable information (like ID card details or passport scans/photos), and financial data (such as banking account details or credit card numbers).
Refund scams typically require remote access as well. In these scams, scammers instruct victims to log into their bank accounts, then use remote software to obscure the victims' screens. Victims are asked to enter a refund amount while their view is obstructed.
During this time, cybercriminals either manipulate the HTML of the bank webpage or transfer money between accounts (for example, from savings to checking). This creates the illusion that victims have received an excessive refund. Scammers then assert that victims made an error in entering the amount and request the return of the surplus. Since no actual funds were deposited into victims' accounts, by refunding the "excess," victims unknowingly send their own money to the scammers.
Scammers often employ difficult-to-trace methods for fund transfers, such as cryptocurrencies, prepaid vouchers, gift cards, or concealing cash in seemingly innocent packages that are then shipped. These methods decrease the chances of prosecution and the recovery of defrauded funds. It is worth noting that once successfully scammed, victims are frequently targeted for further exploitation.
