'Purchase Confirmation' Email Scam Seeks to Steal Your Email Credentials

Upon conducting an investigation on the "Purchase Confirmation" email, it was determined to be a form of spam. This email appears to be a message that confirms a purchase, containing relevant documentation. However, the link provided in the email redirects the user to a phishing website, which targets email login credentials.

The spam email identifies the recipient as a "partner" and claims to have sent the "purchase confirmation" via a secure method. It further provides information regarding the nonexistent documents and requests a confirmation of receipt. However, when clicking on the "PO/27666/19" button, which supposedly leads to the documentation, the user is redirected to a phishing website that is disguised as an email account sign-in page. It is important to note that this "Purchase Confirmation" email is fraudulent, and the website it leads to is fake.

If the user enters their information into the phishing website, it will be recorded and sent to the scammers behind the spam campaign. With this data, the cyber criminals can steal the exposed email accounts, along with the content registered through them. This unauthorized access can be further abused by using hijacked social accounts (e.g., emails, social networking/media, messengers, etc.) to steal their owners' identities and ask their contacts or friends for loans, promote scams, and proliferate malware by sharing malicious files or links.

Moreover, finance-related accounts (for example, online banking, money transferring, digital wallets) can also be stolen and used for fraudulent transactions and online purchases.

What Are the Top Four Signs That an Email is a Scam?

Here are the top four signs that an email is a scam:

• Unusual Sender: The email comes from an unknown or suspicious sender. Check the sender's email address to ensure it is legitimate.
• Urgent or Threatening Language: The email contains urgent or threatening language, which creates a sense of urgency or fear, and prompts you to act quickly without thinking.
• Suspicious Attachments or Links: The email contains suspicious attachments or links, which may lead to malware or phishing websites. Do not click on links or download attachments from unknown or suspicious sources.
• Request for Personal or Financial Information: The email requests personal or financial information such as usernames, passwords, social security numbers, credit card numbers, or bank account information. Legitimate companies will never ask for such information via email.