Secret Shopper / Mystery Shopper Scams

[kas]

Secret Shopper / Mystery Shopper Scams

www.consumerfraudreporting.org/secretshopperscams.php

Related thread: kasha-against-spam.proboards.com/index.cgi?board=kasscams&action=display&thread=45

[kas]

[...]Updated: Saturday, 30 Jun 2012, 1:04 PM CDT
Published : Saturday, 30 Jun 2012, 1:04 PM CDT

MADISON, Wis. (AP) - The state is warning residents to be aware of recent scams involving "secret shoppers" and foreign lotteries.

The Department of Financial Institutions says the scams have been active in Wisconsin over the past several months. The agency says one of the main techniques used by the scammers is mailing unsolicited checks to victims with instructions to cash the checks and wire most of the money to an unknown location.

In the foreign lottery scam, victims are sent a check and told to wire funds to pay taxes and fees before receiving the entire prize. In the "secret shopper" scam, the victim are told to rate the service of certain retailers.

DPI says that in both cases, victims are sent counterfeit checks and are responsible for repaying the bank once the fraud is discovered.[...]

Whole thing is here: www.fox11online.com/dpp/news/wisconsin/state-warns-of-foreign-lottery-scams

[kas]

Got a scam email .. saying it was from CareerBuilder but I think it might be spoofed even though according to the header code it is from them. So I emailed CareerBuilder asking how a scammer was able to contact me with a file attached to the email but the email bounced back to me. I will have to contact them through their site I guess..

Anyway attached is the email as well as a screenshot of the attached file (opened SANDBOXED for security reasons - Do not try this unless you know what you are doing) .. actually the ladder is attached in the 2nd post because on this forum you can only put one attachment per post it seems..

As well as below is the email with the header:

Delivered-To: **EMAIL OBSCURED**
Return-Path: <[e-mail]>
Received: from mail.ecicek.net (mail.ecicek.net. [54.247.84.50])
Received-SPF: fail (google.com: domain of [e-mail] does not designate 54.247.84.50 as permitted sender) client-ip=54.247.84.50;
Authentication-Results: mx.google.com;
spf=hardfail (google.com: domain of [e-mail] does not designate 54.247.84.50 as permitted sender) smtp.mail=[e-mail]
Received: from h11.79.219.67.cable.dynamic.avenuebroadband.com ([67.219.79.11]) by mail.ecicek.net with MailEnable ESMTP; Tue, 12 Feb 2013 00:25:05 +0000
Message-ID: <57627FA8932547ABA5E4201728FFE59C@WIN-HSL84JPS32G>
Reply-To: "CareerBuilder.com" <[e-mail]>
From: "CareerBuilder.com" <[e-mail]>
Subject: Job Opportunity
Date: Mon, 11 Feb 2013 18:24:39 -0600
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5579

This is a multi-part message in MIME format.

------=_NextPart_000_1AE9_01CE0885.0D8A40C0
Content-Type: text/plain;
charset="windows-1251"
Content-Transfer-Encoding: 7bit



You have been selected to become one of our mystery-shopper agent.
The jobs are easy, fun and well paid.


We have sent you an attachment with more information and a signup form.
Download it, read it and signup the form.


You will be contacted to validate your position with us.

GoodDay,
MysteryShopper.Ltd

------=_NextPart_000_1AE9_01CE0885.0D8A40C0
Content-Type: text/html;
name="ApplicationFile.html"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
filename="ApplicationFile.html"

Attachments:

[kas]

Attached is the Sandboxed Attached HTML file

Attachments:

[kas]

Also careerbuilder.com uses an invalid security certificate.

The certificate is only valid for the following names:
*.careerbuilder.pl , *.careerbuilder.dk , *.careerbuilder.co.in , *.careerbuilder.be , *.careerbuilder.it , *.careerbuilder.cn , *.careerbuilder.no , *.careerbuilder.ch , *.careerbuilder.ie , *.careerbuilder.com.cn , *.recrulex.com , *.jobpath.com , *.careerbuildercollege.com , *.empleoscb.com , *.careerbuilder.eu , *.kariera.gr , *.staffnurse.com , *.cao-emplois.com , *.careerbuilder.de , *.careerbuilder.es , *.careerbuilder.nl , *.careerbuilder.se , *.betterjobs.com , *.careerbuilder.co.uk , *.api.careerbuilder.com , careerbuilder.pl , careerbuilder.dk , careerbuilder.co.in , careerbuilder.be , careerbuilder.it , careerbuilder.cn , careerbuilder.no , careerbuilder.ch , careerbuilder.ie , careerbuilder.com.cn , recrulex.com , jobpath.com , careerbuildercollege.com , empleoscb.com , careerbuilder.eu , kariera.gr , staffnurse.com , cao-emplois.com , careerbuilder.de , careerbuilder.es , careerbuilder.nl , careerbuilder.se , betterjobs.com , careerbuilder.co.uk , api.careerbuilder.com

I find it interesting how http://careerbuilder.ca is NOT listed in there. I feel it is still suspicious because their contact page is on a whole different domain. The link being:

https://www.fuzeqna.com/careerbuilder/consumer/question.asp?catid=565

CareerBuilder.com however also had a HELP link but it went to www.careerbuilder.com/JobSeeker/Help/

Looking for CareerBuilder.com on the Better Business Bureau it seems they are NOT accredited:

www.bbb.org/chicago/business-reviews/job-listing-and-advisory-services/careerbuildercom-in-chicago-il-88004265

Seems they also are known for not getting back to reported incidences.

Also the BBB has these listed as associated with that one:

CareerBuilder.ca
CareerBuilder.co.in
cbJobs.es
CareerBuilder.ch
Jobguiden.se
Jobbingmall.nl
cbJobs.it
CareerBuilder.co.uk
CareerBuilder.fr
CareerBuilder.de
Kariera.gr

If you have complaints you want to file to the BBB about CareerBuilder.com it can be done here:

www.bbb.org/chicago/business-reviews/job-listing-and-advisory-services/careerbuildercom-in-chicago-il-88004265/file-a-complaint

Also Netcraft sings their site VERY suspicious:

toolbar.netcraft.com/site_report?url=http://www.fuzeqna.com

[kas]

On the CareerBuilder.com website there is an email address I finally found about Site security here: [e-mail]

[kas]

Okay they did get back to me asking me for the email headers .. which I had already attached to their email form in txt format. Maybe they are legit but they seem kinda moronic ...

Anyway here is their email to me:

Thank you for contacting CareerBuilder's Trust and Site Security Team. We need additional information in order to continue looking into the email you reported. Please reply with the following:

- What we need: The complete email you received, including the extended headers

- How to find headers: If you are not sure how to send us the extended email headers, information on finding full headers can be found at www.haltabuse.org/help/headers/


If you did not receive an email and have a question about a job on the CareerBuilder.com web site, please send us the CareerBuilder JOB LINK URL in question.


Thank you for your time and cooperation.



Thank you for choosing CareerBuilder.com!



Trust and Site Security Team
CareerBuilder | Empowering Employment
Job Seeker Helpline: 866.438.1485
Employer Helpline: 800.891.8880
I hope this resolves your inquiry. If you need additional information, please click the link below to continue our conversation.

http://www.fuzeqna.com/careerbuilder/consumer/clarify.asp?incidentID=%7Baf4d0aca-610c-4f4d-927d-aa050bbbd9f7%7D

Also I found this comparison someone did pretty informative so I decided to share since it is related:

Alexa visitor traffic and WOT numbers for the .com domain:
1. indeed - 200; WOT-90 trust; no spam/phishing reports
2. monster - 500; WOT-87 trust; 20 spam/phishing reports
3. careerbuilder - 700; WOT-89 trust; 85 spam/phishing reports
4. simplyhired - 1800; WOT-87; 4 spam/phishing reports

Someone posted on WoT: www.mywot.com/en/scorecard/fuzeqna.com/comment-471297#comment-471297

My credit union uses fuzeqna.com for online support questions. "

Still investigating this but it seems it has now been submitted as a Phishing attempt to PhishTank here:

www.phishtank.com/phish_detail.php?phish_id=1760694

Also Netcraft warns that it might be a phishing attempt as well by showing this message if you try to visit the email contact form which is on fuzeqna.com: