Internet Scam: BBB Phishing Emails

The Better Business Bureau (BBB) can often be used by scammers to try and steal money and/or identity information from victims. Scammers also use this phishing approach to install viruses on people's computer systems.

This is particularly tricky for small business people who, upon receiving this scam email, will be surprised that someone has lodged a BBB complaint against them and they'll want to click on the link to see what the complaint is about. And that is exactly what the scammer is hoping the victim will do.

If you run across one of these emails, DO NOT CLICK ON ANY LINKS!!!! (Did I say that loud enough??)

If you are unsure of its validity, call the BBB on the phone or open a brand new browser window and *manually* type in bbb.org and see if you can verify the information yourself. But really this is a scam and all the information is made up to try and trick people into clicking on the link. Notice the randomized headers lines for 'Received' and 'Message-ID' below - not from the BBB...

Return-path: [complaints@bbb-email.org]

Received: from [33.4.55.57] (account complaints@bbb-email.org HELO cwofmesekt.akbtcwxwc.net)

From:    "Better Business Bureau" complaints@boston.bbb.org

Message-ID: [8879614814.KRL1FO0J147911@wkueyrdhnfyxxsx.axfwuvj.net]
Subject: Case# 9863703: Terrance Kendall

August 10, 2012 RE: Case# 9863703: Terrance Kendall

Dear Company:As you are aware, the Better  Business Bureau contacted  you regarding the above-named complainant, seeking a response to this complaint. Your position  is available  online.The following  URL (website  address)  below  will take you directly  to this complaint and you will be able to view the response directly  on our website:

http://complaint.app.bbb.org/complaint/view/9863703/b/163980832f (don't click on EITHER of these links, but in the HTML, this link actually goes to: <a href="http://www.11pacific.com/4jdkLnTb/index.html">http://complaint.app.bbb.org/complaint/view/9863703/b/163980832f</a>)

The complainant has been notified  of your  response.The BBB believes  that  your response adequately addresses the disputed  issues and/or  has exhibited  a good faith  effort  to resolve  the complaint. The complaint will close as "Administratively Judged Resolved"  and our records  will be updated.If you fail to honor  your agreement or if the consumer  has information that  disputes  the accuracy of your firm's  response, we will notify  your  office with  substantiation to support  the consumer's position  and the case will be re-opened.  Cases will not be re-opened without documentation or good cause.The BBB appreciates  this opportunity to serve you. Dispute  Resolution  Department.

This is a common scam. There was a massive flurry of them in 2007 and again the BBB warned of these in 2011. Here is their warning from 2011:

Better Business Bureau is issuing an urgent scam alert to local businesses about an e-mail that looks like it is from BBB. Businesses nationwide contacted BBB’s today after receiving an e-mail with the subject line, “BBB Case #64168176 (or other combination of numbers).”  A sample is reprinted below.

This e-mail is fraudulent. Recipients should ignore its contents and delete it immediately. If you clicked on the link in the e-mail message, BBB recommends you run a full virus scan of your computer.

Messages urgently request that recipients click enclosed links to handle pending consumer complaints. Recipients have reported that phishing e-mails are coming from "manager@bbb.org," "admin@bbb.org," "risk@bbb.org" and "alert@bbb.org." and appear to be from the Council of Better Business Bureaus, the national office of the BBB system. They also contain the BBB logo. A link to a non-BBB web site is embedded in the message.

“I suppose we should be honored to have our name used in this scam since this type of fraud typically targets respected organizations.” said David Weiss, President of Cleveland BBB.  “Regardless, it is a serious abuse of our organization and we wanted to alert the business community to this attack.”

While BBB does notify businesses by e-mail when a consumer complaint is received, the e-mail always comes from info@cleveland.bbb.org.  The subject line will be “You have a new message from the BBB Serving Greater Cleveland re: Complaint #XXXXX.”  Also, our phone number is included in the e-mail message – not the contact information for the Council of Better Business Bureaus.

National BBB authorities are working with law enforcement to determine the source of this attack and to stop the fraudulent campaign.

Guess they haven't been able to do much to stop the scammers from using this particular approach because here we are seeing emails exactly like this today. Don't fall for these!