This scam calls on the phone first and claims to offer half off the comcast bill for 2 years if you also sign up for a capital one card through them as part of the promotion. They seemed really legit on the phone, but I was very concerned the info they ask for below when they sent me the email, and also the spelling errors seemed like a red flag, and my son helped me decode the headers in the email, and you can see the emkei.cz origin.
My son says that comcast does not have their SPF set up correctly, and that that makes email spoofing like this possible. If that's true, you really ought to have your IT department fix it, because it makes comcast look bad to be lagging in internet security.
------------------------------
----------------------
I will paste below both the original mail, and the one with the email headers decoded:
Original email:
Dear Customer,
Good Day!
This email refers to the promotion on your current/new services with COMCAST XFINITY, this promotion offers you 50% off in your monthly bill.
With this promotion your existing services i.e. "Comast Internet Blasty" will stay the same as they are right now. No change in equipments or services.
This is a contract free offer for 24 months, with a fix monthly bill of $33.47 per month.
Due balance (if any) will be waived off once you enroll for this new program.
Capital One® is the financial sponsor of this offer and you will keep getting discount as long as you have this card on file. Capital One® card will be shipped to you within 5 working days after subscribing to this promotion.
Kindly fill the following spaces to precede your order:
| NAME | FIRST LAST NAME |
| DATE OF BIRTH | MM/DD/YYYY |
| SOCIAL SECURITY # | XXX-XX-XXXX |
| HOME PHONE # | XXX-XXX-XXXX |
| ADDRESS | |
| ADDRESS (with Residential Prove) | |
*First and Last name of the person who is applying for the card
*Date of Birth of the person who is applying for the card
*SSN of the person who is applying for the card
*applicable for Comcast Voice package (TRIPLE PLAY and DOUBLE PLAY)
*Picture ID (Social Security card/ Driving License/Passport)
*Residential Prove (copy of a bill with Name and address clearly mention)
Please For further queries feel free to call 1866-694-8573 (from 8:00 am till 6:00pm PST).
Regards,
Ross Taylor
Employee ID 36R1
Sales & Promotions Department
COMCAST XFINITY.
* 30 Days money back guarantee. No cancellation or recurring fee applied.
This is a service-related email. COMCAST XFINITY occasionally sends you service-related emails to inform you of service changes, upgrades or new benefits. Services and features are subject to COMCAST XFINITY's standard terms and conditions of service and are subject to change. Copyright 2013 COMCAST XFINITY. All other trademarks are properties of their respective owners. COMCAST XFINITY respects your privacy.
Email headers decoded:
Delivered-To: odellconnie@gmail.com
Received: by 10.31.221.131 with SMTP id u125csp1632020vkg;
Mon, 29 Jun 2015 10:46:19 -0700 (PDT)
X-Received: by 10.180.91.107 with SMTP id cd11mr22839257wib.51.1435599979226;
Mon, 29 Jun 2015 10:46:19 -0700 (PDT)
Return-Path: <no-reply@comcast.net>
Received: from emkei.cz (emkei.cz. [46.167.245.71])
by mx.google.com with ESMTP id fm10si74779774wjc.203.2015.06.29.10.46.18
for <odellconnie@gmail.com>;
Mon, 29 Jun 2015 10:46:19 -0700 (PDT)
Received-SPF: neutral (google.com: 46.167.245.71 is neither permitted nor denied by domain of no-reply@comcast.net) client-ip=46.167.245.71;
Authentication-Results: mx.google.com;
spf=neutral (google.com: 46.167.245.71 is neither permitted nor denied by domain of no-reply@comcast.net) smtp.mail=no-reply@comcast.net;
dmarc=fail (p=NONE dis=NONE) header.from=comcast.net
Received: by emkei.cz (Postfix, from userid 33)
id E3CE6D57AF; Mon, 29 Jun 2015 19:46:15 +0200 (CEST)
To: odellconnie@gmail.com
Subject: Promotional Details
From: "Comcast Xfinity" <no-reply@comcast.net>
X-Priority: 3 (Normal)
Importance: Normal
Errors-To: no-reply@comcast.net
Reply-To: ross36r1@comcast.net
Content-Type: text/html; charset=utf-8
Message-Id: <20150629174616.E3CE6D57AF@emkei.cz>
Date: Mon, 29 Jun 2015 19:46:15 +0200 (CEST)
<p><img src="http://forums.comcast.com/t5/image/serverpage/image-id/14435i6E0FEDE67CAF2A8F/image-size/original?v=mpbl-1&px=-1" alt="" width="125" height="70" /></p>
<p><em>Dear Customer,</em></p>
<p><em> </em></p>
<p><em>Good Day!</em></p>
<p><em>This email refers to the promotion on your current/new services with COMCAST XFINITY, this promotion offers you 50% off in your monthly bill.</em></p>
<p><em> </em></p>
<p><em>With this promotion your existing services i.e. <strong>"Comast Internet Blasty"</strong> will stay the same as they are right now. No change in equipments or services.</em></p>
<p><em> </em></p>
<p><em> </em></p>
<p><em>This is a contract free offer for 24 months, with a fix monthly bill of $33.47 per month.</em></p>
<p><em>Due balance (if any) will be waived off once you enroll for this new program.</em></p>
<p><em> </em></p>
<p><em>Capital One® is the financial sponsor of this offer and you will keep getting discount as long as you have this card on file. Capital One® card will be shipped to you within 5 working days after subscribing to this promotion.</em></p>
<p><em> </em></p>
<p><strong><em>Kindly fill the following spaces to precede your order:</em></strong></p>
<table>
<tbody>
<tr>
<td>
<p><strong><em>NAME </em></strong></p>
</td>
<td>
<p><em>FIRST LAST NAME </em></p>
</td>
</tr>
<tr>
<td>
<p><strong><em>DATE OF BIRTH</em></strong></p>
</td>
<td>
<p><em>MM/DD/YYYY</em></p>
</td>
</tr>
<tr>
<td>
<p><strong><em>SOCIAL SECURITY #</em></strong></p>
</td>
<td>
<p><em>XXX-XX-XXXX</em></p>
</td>
</tr>
<tr>
<td>
<p><strong><em>HOME PHONE #</em></strong></p>
</td>
<td>
<p><em>XXX-XXX-XXXX</em></p>
</td>
</tr>
<tr>
<td>
<p><strong><em>ADDRESS</em></strong></p>
</td>
<td>
<p><em> </em></p>
</td>
</tr>
<tr>
<td>
<p><strong><em>ADDRESS </em></strong><strong><em>(with Residential Prove)</em></strong></p>
</td>
<td>
<p><em> </em></p>
</td>
</tr>
</tbody>
</table>
<p><em> </em></p>
<p><em>*First and Last name of the person who is applying for the card</em></p>
<p><em>*Date of Birth of the person who is applying for the card</em></p>
<p><strong><em>*</em></strong><em>SSN of the person who is applying for the card</em></p>
<p><strong><em>*</em></strong><em>applicable<strong> </strong>for Comcast Voice package (TRIPLE PLAY and DOUBLE PLAY)</em></p>
<p><em>*Picture ID (Social Security card/ Driving License/Passport)</em></p>
<p><strong><em>*</em></strong><em>Residential Prove (copy of a bill with Name and address clearly mention)</em></p>
<p><em> </em></p>
<p><em> </em></p>
<p><em>Please For further queries feel free to call 1866-694-8573 (</em><em>from 8:00 am till 6:00pm PST).</em></p>
<p><em> </em></p>
<p><em> </em></p>
<p><strong><em> </em></strong></p>
<p><strong><em>Regards,</em></strong></p>
<p><em>Ross Taylor</em></p>
<p><em>Employee ID 36R1</em></p>
<p><em>Sales & Promotions Department</em></p>
<p><em>COMCAST XFINITY.</em></p>
<p><em> </em></p>
<p><em> </em></p>
<p> <img src="http://cdn.comcast.com/~/Media/ImageLibrary/responsive-seo-local/customer-service-logo.png?vs=1" alt="" width="60" height="70" /> </p>
<p><em> </em></p>
<p><em> <sub>* 30 Days money back guarantee. No cancellation or recurring fee applied.</sub></em></p>
<p><sub><em> </em></sub></p>
<p><sub><em> </em></sub></p>
<p><sub><em>This is a service-related email. COMCAST XFINITY occasionally sends you service-related emails to inform you of service changes, upgrades or new benefits. Services and features are subject to COMCAST XFINITY's standard terms and conditions of service and are subject to change. Copyright 2013 COMCAST XFINITY. All other trademarks are properties of their respective owners. COMCAST XFINITY respects your privacy.</em></sub></p>
<p><sub> </sub></p>
<p> </p>
<p> </p>
<p> </p>
No comments:
Post a Comment