Scammers are Scamming: Be Afraid

Raise your hand if you remember the “Is it live, or is it Memorex?” commercial? Change a few words, and that’s how you should consider emails you receive that ask you to enter personal information: Is it real, or is it a scam? 

Of the countless emails we receive, scam and otherwise, we have selected two to illustrate what we examine when assessing the validity of an email and how to verify its authenticity. Although we’re not experts, it’s essential to follow at least a few simple steps before acting on any emails you may receive. 

Dashlane

Below, please find an email we received from Dashlane, which is a password manager that allows you to maintain all your passwords in a single, secure location. As we’re both fans and users, imagine our concern when we received the alert below: 

Read the email. Do you see anything suspicious?

Let’s start with the email address of the sender, the first place you should look when you receive any official-looking email. Looking at the “From” address, was the email sent by someone at Dashlane.com? 

In this instance, the return address shows “shopviu.com”. That alone should alert you that the email is a fraud, and the email should be deleted. If you’re still in doubt, Google “shopviu”; you’ll find it’s allegedly an eyewear company. This is an email from a scammer. Not only should it be deleted, but it’s even questionable whether you should buy your glasses from shopviu.com.

PNC Bank

Email #2 allegedly came from our friends at PNC Bank, or did it?  It’s too long to include in our newsletter, but here are the key points:   

• After 30 years, PNC was reaching out to confirm pertinent information about our business, including EIN number, related Social Security number(s), and our online PIN.  They were also asking us to confirm account numbers and mailing addresses.

• We were to click the link in the email, which would take us to a website where we would enter the required information.

• The email even included a consequence if we didn’t respond – potential account closure.

Our initial response was to declare fraud. After 30 years, PNC Bank picked that week to confirm our business information? Information they wanted us to re-enter on ‘their’ website? Really?

On the other hand, what if we really are required to complete a certain form lest PNC Bank puts a hold on our account? What if this is legitimate? 

As we did with Dashlane, the first thing we did was check the sender’s email address, which did, in fact, include “@pnc.com”. That may feel compelling, but it’s not conclusive, because you can falsify a sender’s email address.   

The email also includes a website we’re instructed to visit to complete this allegedly required form. The website included the letters “pnc.com” within the address, but, at least to us, its validity was still inconclusive.

 A phone number is included in the email, which can be called for assistance. To confirm the authenticity of that number, we went to the official PNC website. When the phone number in the email did not appear on the website, our level of suspicion rose even further. (NOTE: Never click on a website link included in a suspicious email, and never call a phone number included in the body of the email. Instead, Google the company name and go directly to its official website.)

Finally, we called a PNC phone number listed on the official PNC website, where we eventually spoke to a representative in the business banking department.  Lo and behold, this email was legitimate, and a PNC representative verified the phone number included in the email. She also said they’ve received quite a few phone calls from their business customers. Like us, those customers were all correct to call to seek verification from a trusted number. Kudos to them, and to us. 

Did this process take a few minutes? Absolutely, but it’s the only way to be sure you’re responding to a legitimate website if/when you’re requested to enter personal, or, as in our case, business information. 

When it comes to emails and unsolicited phone calls, we should all follow the advice used by good carpenters: measure twice and cut once. Think twice (or more) before providing personal information on a phone call or opening unsolicited links either in an email or a pop-up on your computer. (And don’t forget you can always call or email us with any questions.) The potential cost of making a mistake can be far worse than the extra few minutes it takes to confirm the integrity of the sender (or caller).