Looks authentic but be careful!

[AngloDutch]

I have been receiving what now looks certainly to be scam mails to my own personal email address.

Both have files included (.txt), but I am not sure if that they are actually just text files, as I read somewhere that they can be disguised as such (I haven't clicked on them).

Here is what we have received:

From: Alexander Lawson [mailto:alexanderlawson905@gmail.com]
Sent: 15 October 2015 12:29
To: xxxxxx xxxxxxxx
Subject: Enquiry From Alexander

Hi , I am having trouble logging in to the owners direct site. Can I ask before we go ahead and book, would you be able to provide a cot for a 2 year old? We have 4 adults and 3 children as you can see and we would need somewhere for the 2 year old to sleep, but a cot would solve the problem. Would you please advise us on how to proceed? Looking forward to your reply. Best Wishes Alexander

and

From: Mary Nall [mailto:mary.nall@hotmail.com]
Sent: 17 October 2015 13:24
To: xxxxxx xxxxxxxxx
Subject: Possibile Booking?

Hello , can i please know if this property is available in the period i required? i am very interested in renting it. Arrival date: 1-January-2016 Departure date: 9-January-2016 Many thanks. Mary

Has anyone else been receiving these? They do look genuine, but now the second similar email arrived tonight. I only replied to the first one...

[Ele]

I received the exact same enquiry from Alexander Lawson, exact same content, received on my private email address 15th October 12.24hrs.

No attachments, so as yet not quite sure what the scam is!

[AngloDutch]

I received the exact same enquiry from Alexander Lawson, exact same content, received on my private email address 15th October 12.24hrs.

No attachments, so as yet not quite sure what the scam is!

Thanks very much, Ele for letting me know. If you didn't get the file, then it must have been a mistake on their part, I can't think of anything else.

So, you received the same email 5 minutes before us, although your property is in Spain and ours is in the NL? It's definitely a scam.

As they have our private addresses, then it must be the .txt attachment which, if it's not a virus (from my experience, normally a .zip or .exe file, but I'm sure that they can be disguised - does anyone know whether .txt can contain viruses?), it must hold SPAM or something similar. But I'm not going to click it to find out. Our Norton didn't spring to life when it arrived, so have no idea what it is.

And now something similar from a 'Mary Nall'....

Must say getting pretty fed up with these people...last week (as you know, Ele, as you also received the exact same email request) we were victims of the HA scam where we were asked to contact the enquirer directly to their email address.

In the following days, both our eBay and PayPal accounts were subsequently hacked (see viewtopic.php?t=24780)

[AngloDutch]

The attachments look like this:

Untitled attachment 00076.txt (127 B)

and

Untitled attachment 00009.txt (127 B)

Note that the files are exactly the same size.

If you are receiving these emails, treat as spam/scam

[kevsboredagain]

No a txt cannot contain a virus if it really is a text file. Sometimes they try to trick you with the filename though. Maybe it's call file.txt.exe and you just don't see the exe part.

Any txt file is safe to open with a text editor, like Notepad. In fact you can open any file, even if it were a virus with a text editor and no harm can be done - you'll just see all the bytes as ASCII characters. Just don't double click the file in case it's not a txt extension. Open Notepad first then drag the file in or go look for it.

Seeing txt files in an email is not that uncommon. Sometimes email software or servers do not handle images or html content correctly and put the contents into txt files as attachments. That on it's own is not the sign of a scam.

I would just ignore the txt files, as in any case they will contain nothing useful and reply with caution.

If too scared to open the files, I would be happy to take a look and let you know what they are.

[AngloDutch]

Seeing txt files in an email is not that uncommon. Sometimes email software or servers do not handle images or html content correctly and put the contents into txt files as attachments. That on it's own is not the sign of a scam.

I would just ignore the txt files, as in any case they will contain nothing useful and reply with caution.

If too scared to open the files, I would be happy to take a look and let you know what they are.

This is what I thought too. You sometimes get attachments in emails don't you where logos, etc. haven't come through properly and you get them as attachments. When I received the first email, I googled 'alexanderlawson905@gmail.com' and actually found an Alexander Lawson in Ontario, Canada with phone area code 905.


http://www.whitepagescanada.ca/on/burli ... on_874008/


I was certain that he was real. It was the only Alexander Lawson showing in the results as well. We are getting many genuine enquiries from Canada at the moment and many to our private email address as well.

I actually thought nothing of it. Although I found the need to log in to OD a bit odd, if we were not to reply to an email because of something 'silly' that a guest wrote then I think we would have lost a lot of bookings over the years.

Kev, about opening the attachments, yes please. We've made enough mistakes recently and I would appreciate someone who knows how to properly contain these things to take a look. It looks like other LMH's could be getting these exact same emails, but are unaware that the enquiries are not genuine.

I will PM YOU. Thanks.

[naturepom]

See last example of fake request:

From: Mary Nall <mary.nall@hotmail.com>
Date: 2015-10-17 12:12 GMT+01:00
Subject: Possibile Booking?
To: naturepom@gmail.com


Hi , I am having trouble logging in to the booking site. Can I ask before we go ahead and book, would you be able to provide a cot for a 2 year old? We have 4 adults and 3 children as you can see and we would need somewhere for the 2 year old to sleep, but a cot would solve the problem. Would you please advise us on how to proceed? Looking forward to your reply. Best Wishes Mary

After my answer, I receive the following:

From: Mary Nall <mary.nall@hotmail.com>
Date: 2015-10-18 14:04 GMT+01:00
Subject: RE: Possibile Booking?
To: Naturepom Actividades Turisticas <naturepom@gmail.com>

Mary Nall has made the payment
Mary Nall already paied to stay at your property!
You have received a payment for your property.
You have 10 hours left to accept the payment. After this time, if you have not accepted to the payment, it will be automatically declined for you.

Accept


Decline

Property # property

Unit Unit #1063950
Reservation ID HA-S2TD9C
Payment Has Made
Guests View in dashboard
Traveler name Mary Nall


So, with all links to unknow pages, it seems to be a bullshit...

[kevsboredagain]

naturepom, one goal of scammers is to persuade you to reveal your email address so they can send dodgy links. You've made it somewhat easier by publishing yours publicly.

Welcome to LMH

[AngloDutch]

See last example of fake request:

From: Mary Nall <mary.nall@hotmail.com>
Date: 2015-10-17 12:12 GMT+01:00
Subject: Possibile Booking?
To: naturepom@gmail.com


Hi , I am having trouble logging in to the booking site. Can I ask before we go ahead and book, would you be able to provide a cot for a 2 year old? We have 4 adults and 3 children as you can see and we would need somewhere for the 2 year old to sleep, but a cot would solve the problem. Would you please advise us on how to proceed? Looking forward to your reply. Best Wishes Mary

Yes, welcome to LMH, naturepom and thanks for confirming that the Nall email is also from the same people.

The email you received is exactly the same as the first one we received apart from referring to OD. Did you receive an attachment as well in the first email?