URGENT - Suspected phishing attempt

[Warwick]

Beware of emails received appearing to be from John Wallett.

I've just received a very suspicious one that appears to come from his address, but the recipient's address, mine, is blank. So it is probably a broadcast email addressed to everyone on his address list. The email subject is "Catching up" and it asks you to reply by email rather than telephoning him. It says that he needs your help.
I've sent John a message via the forum and also one to David (Admin).

[enigmas]

Hi Warwick,
I just received a similar email with text virtually as you have outlined. It's not likely that John would phone me from the UK...so I thought it very odd! Iwas just about to check via this forum until I noticed your post. 👍

[lagain]

I had one as well, but thought the wording was a bit iffy and deleted it, a real nuisance when that happens.

[Eric R]

i also have received this email. Some months ago I had received one allegedly from our chairman and also advised him.
In addition of have a lot of phishing emails separately but i notice all were addressed to my P5Club forum user name - the only place i use it. From that i deduce that the system providers security is failed. Unusually i have to agree cookies every time i log in (to which i agree essential only) so is this feature new?
Scammers arnt after your email address but your bank ID and when you wake up your account has been raised or emptied.

[djm16]

I recommend that we all set our browser to automatically delete cookies and other saved data whenever we exit the browser. If you are not sure how to set that up, then you can delete manually with:
"Ctrl-Shift-Del"

Note, this is not the same as "Ctrl-Alt-Del" which used to be the signal to soft reboot.

Lastly, never do anything important (like banking etc) from a mobile phone, and turn off your mobile phone frequently.

[Ken Nelson]

I also got one of these scam messages in the USA.

[Warwick]

I suspect that it isn't the forum that's been compromised, but that it's John's computer.
Would I be right in guessing that all of you who have posted in this thread have had email communication directly with John?
Because there was no external link or attachments in the email, and because it was sent to my old address which will end in a month or two due to changing service providers, I was comfortable replying to the email to see what the response was.
I updated my email address on the forum about a week ago, so that's another reason why I'm reasonably confident that it's not a forum hack.
Notice that the first email came from John's legitimate address, but subsequent ones came from a Gmail address.
Is anyone able to phone John and alert him to what's happening, just in case he doesn't know?

Here is the content of my email discussion with the sender.
I've put the time and date in bold to make it easier to see the sequence.
I also gave my name as Rick, to see if they addressed me by name in the replies, but they didn't. It's clearly not an automated response. I'll reply to them tomorrow as promised, and see what happens.


From: John Wallett [mailto:[e-mail]]
Sent: Monday, 22 July 2024 11:12 PM
Subject: Catching up

I hope all is well with you? I can't call for now, I'm having difficulty with speaking due to a serious throat pain cause by laryngitis that's the reason why I emailed you.
Actually, I need a favour from you!
John


On Mon, Jul 22, 2024 at 2:45 PM Warwick <[e-mail]> wrote:
Hi John,

What’s up?


On 23 Jul 2024, at 12:06 am, John Wallett <[e-mail]> wrote:

Glad to hear from back you, I've been trying to purchase an Apple gift card for a friend’s daughter who is down with cancer of the Liver, it's her birthday today and I promised to get it for her today, but I can't do this now because all my effort purchasing it online proved abortive. Can you get it from any nearby shop around you? I'll reimburse you back as soon as possible. Please let me know if you can handle this so I can tell you the amount and how to get to her.

Thanks
John


On Mon, Jul 22, 2024 at 3:30 PM Warwick Brooks <[e-mail]> wrote:
Hi John,

Sorry that you’re not feeling well. The closest Apple store is about 30 minutes drive from here. I won’t be going near there until Thursday. Is that too late?

Rick.


On 23 Jul 2024, at 12:37 am, John Wallett <[e-mail]> wrote:

Thank you so much, the amount I promised to send her is 200. You can purchase it from any shop or supermarket around you, she needs it to purchase something online and I promised to do anything for her. No need to post or drop it, I need you to remove the card from its pack, you will find a peel-able silver foil at the back of the card, gently peel the silver foil to reveal the pin which usually starts with an "X", then easily write out the pins and send them to me so I can forward it to her.

I owe you a lot.
John


From: Warwick Brooks [mailto:[e-mail]]
Sent: Tuesday, 23 July 2024 12:54 AM
To: John Wallett <[e-mail]>
Subject: Re: Catching up

I don’t live in the town anymore John. We moved to the farm permanently a few months ago. I’ll ask at the supermarket when I do the shopping tomorrow afternoon and let you know.

Rick

[Eric R]

In recent weeks ive been required to accept cookies in full or selected. where i hadn't before (ie P5 Club). Indeed one in particular doesn't allow me to go any further without accepting in full.
As for email addresses, surely someone breeches a site security somewhere/somehow?
How does automatically deleting cookies and other saved data whenever we exit the browser work? Why doesnt preferences remain for following visits to the same site?

[Warwick]

I've received nothing more from them. They must have realised that I was leading them on.