Email lotto scam starts to spread

by Steve Ragan - Mar 5 2008, 13:00

An email that is supposedly from Oxfam, tells the reader they have been chosen as a final recipient of £850,000 ($1.6 million) grant/donation. The scam started out in the U.K., where Oxfam is known as a highly respected aid giver, but is now appearing in the U.S. with the same spin, send them your info and they will send you money.

Sophos has a report on this scam, and points to how these types of tricks are just the sort of thing Phishers will use to get your information.

"Oxfam is one of the world's most respected aid agencies, fighting famine around the globe. But the sick people behind this scam don't seem to have any qualms about bringing the charity's name into disrepute," said Graham Cluley, of Sophos. "Of course, Oxfam is not responsible for the email and internet users need to learn that any unsolicited lottery win email arriving in their inbox is likely to be sent by a conman, not a charity worker."

Graham has a very valid point. Emails like this fall in to the category of “if it looks to good to be true…” and will often cost you more money than you will earn. Some interesting red flags in the email are the Live.com email address used for contact as well as the 070 prefix on the contact phone number.

Known as 'personal numbers', 070 numbers look like mobile phone numbers, but can actually be easily redirected to any number anywhere in the world. In addition, 070 numbers can be acquired free, as higher charges are paid by the caller to use them.

"Email lottery scams are abusing 070 telephone numbers to steal money and confidential information," continued Cluley. "By redirecting the number overseas, criminals can fool victims into believing they are speaking to a legitimate agency rather than a bunch of identity crooks focused on raiding bank accounts."

The 070 number aside, the email contact is a free account. If this were a legit award email, wouldn’t the winner call the legit office? Why would someone interested in a £850,000 grant email a Live.com address?

Again, while the scam is moving around the internet, the best defense is simply to ignore it, and any other such offers. If it looks to good to be true…it probably is.

Around the Web